Executive brief
OpenEXR is a standard software library used in the motion picture and visual effects industries to handle high-quality image files. A flaw in how it processes certain compressed images allows a specially crafted file to crash applications that open it, such as image viewers, thumbnail generators, or video editing software. This could lead to service disruptions or the potential exposure of small amounts of technical data from the computer's memory.
Technical details
A heap-based buffer overflow exists in the HTJ2K (High-Throughput JPEG 2000) decoder within OpenEXRCore. The function `ht_undo_impl()` fails to validate that the dimensions declared in the HTJ2K codestream match the dimensions advertised in the EXR header. Specifically, the decoder uses the EXR channel's width as an iteration count to pull 32-bit samples from an `ojph` line buffer without verifying the buffer's actual length. An attacker can provide a crafted EXR file where the codestream declares smaller dimensions than the header, triggering a 4-byte out-of-bounds read. This results in a denial-of-service (crash) and potential adjacent-heap information disclosure. The issue is fixed in version 3.4.12.
Affected products
- AcademySoftwareFoundation OpenEXR 3.4.0 - 3.4.11
Timeline
- 2026-05-25: patched: Version 3.4.12 released
- 2026-06-18: disclosed