Is CVE-2026-45696 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45696 being exploited in the wild.

How severe is CVE-2026-45696?

Informational severity, with a CVSS score of 8.3, published 18 June 2026.

Which products and versions are affected?

AcademySoftwareFoundation OpenEXR 3.4.0 - 3.4.11.

Is there a fix for CVE-2026-45696?

A patch was published on 2026-05-25: Version 3.4.12 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45696 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45696?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45696: OpenEXR heap buffer overflow in HTJ2K decoder

CVE-2026-45696 · Severity: info · CVSS 8.3 · Published 2026-06-18

OpenEXR is a standard software library used in the motion picture and visual effects industries to handle high-quality image files. A flaw in how it processes certain compressed images allows a specially crafted file to crash applications that open it, such as image viewers, thumbnail generators, or video editing software. This could lead to service disruptions or the potential exposure of small amounts of technical data from the computer's memory.

Quick answers

Is CVE-2026-45696 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45696 being exploited in the wild.
How severe is CVE-2026-45696?: Informational severity, with a CVSS score of 8.3, published 18 June 2026.
Which products and versions are affected?: AcademySoftwareFoundation OpenEXR 3.4.0 - 3.4.11.
Is there a fix for CVE-2026-45696?: A patch was published on 2026-05-25: Version 3.4.12 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45696 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45696?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the HTJ2K (High-Throughput JPEG 2000) decoder within OpenEXRCore. The function `ht_undo_impl()` fails to validate that the dimensions declared in the HTJ2K codestream match the dimensions advertised in the EXR header. Specifically, the decoder uses the EXR channel's width as an iteration count to pull 32-bit samples from an `ojph` line buffer without verifying the buffer's actual length. An attacker can provide a crafted EXR file where the codestream declares smaller dimensions than the header, triggering a 4-byte out-of-bounds read. This results in a denial-of-service (crash) and potential adjacent-heap information disclosure. The issue is fixed in version 3.4.12.

Affected products

AcademySoftwareFoundation OpenEXR 3.4.0 - 3.4.11

Timeline

2026-05-25: patched: Version 3.4.12 released
2026-06-18: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.