Junglewise Threat Intelligence

CVE-2026-34545: AcademySoftwareFoundation OpenEXR heap overflow in HTJ2K decoder

CVE-2026-34545 · Severity: high · CVSS 7.3 · Published 2026-04-01

Technologies: AcademySoftwareFoundation OpenEXR, Red Hat Enterprise Linux 6. Vendors: Red Hat.

Executive brief

OpenEXR is a standard library used for handling high-quality image files in the motion picture and visual effects industries. A security flaw allows an attacker to create a malicious image file that, when opened by a vulnerable application, can corrupt the computer's memory. This could allow an attacker to take control of the system or cause the application to crash, potentially leading to data loss or unauthorized access to sensitive production assets.

Technical details

A heap-based buffer overflow exists in OpenEXR's HTJ2K decoder within `internal_ht.cpp`. The vulnerability is caused by an integer overflow where an `int16_t` is used as a loop counter for copying decompressed samples, while the channel width is an `int32_t`. When a crafted EXR file specifies a channel width of 32768 or greater, the counter wraps around to a negative value, leading to out-of-bounds reads and writes. An attacker can leverage this to write controlled data beyond the output heap buffer. The issue is present in versions 3.4.0 through 3.4.6 and was fixed in version 3.4.7 by updating the loop iterators to `int32_t`. Exploitation typically requires a user to open a malicious .exr file.

Affected products

  • AcademySoftwareFoundation OpenEXR >= 3.4.0, < 3.4.7
  • Red Hat Red Hat Enterprise Linux 6 affected

Timeline

  • 2026-03-15: patched: Version 3.4.7 released with fix.
  • 2026-03-27: advisory: GitHub Security Advisory GHSA-ghfj-fx47-wg97 published.
  • 2026-04-01: disclosed: CVE-2026-34545 published.

References