Technical impact
OpenEXR versions 3.4.0 through 3.4.12 contain a flaw in the HTJ2K decoding path that allows a maliciously crafted HTJ2K‑compressed EXR file to trigger an assertion failure in the vendored OpenJPH library. This assertion causes the OpenEXR library to abort the process unconditionally, leading to a denial‑of‑service condition whenever an application calls exr_start_read on an untrusted input. The weakness stems from improper validation of quantization delta parameters (integer overflow) and an uninitialized pointer, which is covered by CWEs 190, 617, and 824.
Affected Systems
The issue affects the Academy Software Foundation’s OpenEXR library, specifically versions 3.4.0 through 3.4.12. OpenEXR is widely deployed in motion‑picture production pipelines and other imaging workflows that handle EXR files.
Risk and Exploitability
Although the EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, the nature of the flaw—an unconditional abort triggered by a crafted EXR file—implies a high impact denial of service. The CVSS score is not provided in the supplied data, but the criteria would place it in the high to critical range due to loss of availability in any application processing untrusted input. Because the issue is triggered by a file that can be supplied by an external actor, an attacker can easily deliver a malicious image to an application that calls exr_start_read, causing the process to terminate. The lack of a reported CVSS does not change the fact that the error path cannot be recovered, so organizations should treat this as a high‑priority problem even with a low EPSS.
