Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field (PLEN) from a chunk's compressed data but never checks that this value fits within the available buffer before using it. When decoding, it advances the codestream pointer by the attacker-supplied header size and passes the resulting offset and remaining length to the OpenJPH memory-input path, so a crafted value pushes the pointer past the end of the buffer and causes an out-of-bounds read. Because this field comes straight from attacker-controlled EXR chunk data, the flaw is reachable during normal decoding of an untrusted file. This issue is fixed in version 3.4.13.
Published: 2026-08-25
Score: 6.7 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

HTJ2K decoder in OpenEXR 3.4.0‑3.4.12 reads a PLEN field from a chunk header without checking the value against the available buffer. The unchecked header length is then used to advance a codestream pointer and feed the offset to the OpenJPH memory‑input path, which allows a crafted file to cause an out‑of‑bounds read. This is a buffer read flaw (CWE‑125) combined with improper input validation (CWE‑20) that can expose confidential data that resides beyond the decoder buffer.

Affected Systems

OpenEXR from version 3.4.0 to 3.4.12 released by AcademySoftwareFoundation. The issue is fixed in 3.4.13 and later.

Risk and Exploitability

The vulnerability carries a CVSS v3.1 score of 6.7 (Medium) and has no EPSS score available. It is not listed in the CISA KEV catalog. Because the flaw is triggered by an untrusted EXR file, the attack vector is a crafted file supplied to the decoder, either locally or in a file upload context. The vulnerability can lead to confidentiality compromise but does not provide remote code execution or persistence on its own.

Generated by OpenCVE AI on August 25, 2026 at 22:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenEXR to version 3.4.13 or later.
  • If an upgrade is not immediately possible, implement strict input validation that rejects or limits PLEN values before decoding the chunk.
  • Monitor AcademySoftwareFoundation advisories for additional patches or mitigation guidance.

Generated by OpenCVE AI on August 25, 2026 at 22:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Description OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field (PLEN) from a chunk's compressed data but never checks that this value fits within the available buffer before using it. When decoding, it advances the codestream pointer by the attacker-supplied header size and passes the resulting offset and remaining length to the OpenJPH memory-input path, so a crafted value pushes the pointer past the end of the buffer and causes an out-of-bounds read. Because this field comes straight from attacker-controlled EXR chunk data, the flaw is reachable during normal decoding of an untrusted file. This issue is fixed in version 3.4.13.
Title OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)
Weaknesses CWE-125
CWE-20
References
Metrics cvssV4_0

{'score': 6.7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T19:16:25.169Z

Reserved: 2026-07-23T18:54:15.831Z

Link: CVE-2026-65979

cve-icon Vulnrichment

Updated: 2026-08-25T19:16:18.869Z

cve-icon NVD

Status : Received

Published: 2026-08-25T19:16:52.307

Modified: 2026-08-25T20:17:01.020

Link: CVE-2026-65979

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T22:30:17Z

Weaknesses