Vulnerability · Published Aug 25, 2026 · Assigned by GitHub_M
CVE-2026-65979OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)
Medium 6.7
In plain English
A medium-severity improper input validation in openexr from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field (PLEN) from a chunk's compressed data but never checks that this value fits within the available buffer before using it. When decoding, it advances the codestream pointer by the attacker-supplied header size and passes the resulting offset and remaining length to the OpenJPH memory-input path, so a crafted value pushes the pointer past the end of the buffer and causes an out-of-bounds read. Because this field comes straight from attacker-controlled EXR chunk data, the flaw is reachable during normal decoding of an untrusted file. This issue is fixed in version 3.4.13.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | openexr | 3.4.14-0.1 | DEBIAN-CVE-2026-65979 |
| Ubuntu:26.10 | openexr | no fix listed | UBUNTU-CVE-2026-65979 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.4.0, < 3.4.13 |
Weakness: CWE-20, CWE-125 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3j9c-j7c9-x293 x_refsource_CONFIRM
- https://github.com/AcademySoftwareFoundation/openexr/commit/c7af2d233b7b2a4452c11f26cf47584cc2b35721 x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.13 x_refsource_MISC