Executive brief
OpenEXR is the industry-standard image format library used widely in film and visual effects production. A specially crafted HTJ2K-compressed image file causes any application reading untrusted EXR files to crash immediately and unconditionally, disrupting workflows and causing service outages. This denial-of-service vulnerability affects organizations relying on automated image processing pipelines and asset management systems.
Technical details
A reachable assertion vulnerability (CWE-617) exists in OpenEXR's handling of HTJ2K-compressed images. The vulnerability is triggered when a QCD (quantization component) marker with invalid lower five bits is parsed; the vendored OpenJPH 0.26.3 library contains an unguarded assert() instead of a recoverable error handler at the validation point. When processing a crafted EXR file via exr_start_read(), the codestream creation path invokes this assertion, causing immediate process abort (SIGABRT) that cannot be caught by application error handling. The root cause spans two components: the assert() in OpenJPH's param_qcd::get_irrev_delta() and insufficient try/catch wrapping in OpenEXR's ht_undo_impl(). The vulnerability requires only a network-accessible EXR file and user action to open it; no authentication or special privileges are needed. Patched in OpenEXR 3.4.13 by validating HTJ2K chunk headers before decode and ensuring proper error propagation.
Affected products
- Academy Software Foundation OpenEXR 3.4.0 through 3.4.12
Timeline
- 2026-06-23: disclosed
- 2026-06-19: patched: Fixed in version 3.4.13