Executive brief
OpenEXR is a widely-used image format for motion pictures and visual effects. A crafted HTJ2K-compressed EXR file can trigger an unconditional process crash (denial of service) in any application that reads untrusted EXR files, including professional VFX pipelines and rendering farms. The vulnerability stems from improper error handling in the compression codec and cannot be caught by application-level error handlers.
Technical details
A reachable assertion failure exists in OpenEXR's HTJ2K decode path when processing HTJ2K-compressed EXR files. The vulnerability is triggered by a QCD marker whose lower five bits are zero; OpenEXR passes this invalid value to the vendored OpenJPH library without proper validation. The OpenJPH library uses an assertion (rather than recoverable error handling) to validate quantization delta parameters, causing a direct abort() call that cannot be intercepted. OpenEXR compounds this by wrapping only its HT header parser in error handling while leaving downstream codestream read and construction calls unprotected. An attacker can supply a malicious EXR file to any application that calls exr_start_read() on untrusted input, resulting in immediate process termination. The issue has been patched in version 3.4.13.
Affected products
- Academy Software Foundation OpenEXR 3.4.0 through 3.4.12
Timeline
- 2026-08-25: disclosed
- 2026: patched: Fixed in version 3.4.13