CVE-2026-34545: AcademySoftwareFoundation OpenEXR heap overflow in HTJ2K decoder

CVE-2026-34545 · Severity: high · CVSS 7.3 · Published 2026-04-01

OpenEXR is a standard library used for handling high-quality image files in the motion picture and visual effects industries. A security flaw allows an attacker to create a malicious image file that, when opened by a vulnerable application, can corrupt the computer's memory. This could allow an attacker to take control of the system or cause the application to crash, potentially leading to data loss or unauthorized access to sensitive production assets.

Quick answers

Is CVE-2026-34545 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34545 being exploited in the wild.
How severe is CVE-2026-34545?
High severity, with a CVSS score of 7.3, published 1 April 2026.
Which products and versions are affected?
AcademySoftwareFoundation OpenEXR >= 3.4.0, < 3.4.7; Red Hat Red Hat Enterprise Linux 6 affected.
Is there a fix for CVE-2026-34545?
A patch was published on 2026-03-15: Version 3.4.7 released with fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34545 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-34545?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in OpenEXR's HTJ2K decoder within `internal_ht.cpp`. The vulnerability is caused by an integer overflow where an `int16_t` is used as a loop counter for copying decompressed samples, while the channel width is an `int32_t`. When a crafted EXR file specifies a channel width of 32768 or greater, the counter wraps around to a negative value, leading to out-of-bounds reads and writes. An attacker can leverage this to write controlled data beyond the output heap buffer. The issue is present in versions 3.4.0 through 3.4.6 and was fixed in version 3.4.7 by updating the loop iterators to `int32_t`. Exploitation typically requires a user to open a malicious .exr file.

Affected products

  • AcademySoftwareFoundation OpenEXR >= 3.4.0, < 3.4.7
  • Red Hat Red Hat Enterprise Linux 6 affected

Timeline

  • 2026-03-15: patched: Version 3.4.7 released with fix.
  • 2026-03-27: advisory: GitHub Security Advisory GHSA-ghfj-fx47-wg97 published.
  • 2026-04-01: disclosed: CVE-2026-34545 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.