Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-68516 EUVD-2026-65178

OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow

Published Aug 24, 2026 · Updated Aug 25, 2026 · Assigned by GitHub_M

Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.

Affected products

VendorProductAffectedFixed
AcademySoftwareFoundation openexr >= 3.4.0, < 3.4.14 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 openexr 3.4.14-0.1 —
Debian 12 openexr No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 openexr No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS openexr No fix yet —
Ubuntu Pro 24.04 LTS openexr No fix yet —
Ubuntu Pro 22.04 LTS openexr No fix yet —
Ubuntu Pro 20.04 LTS openexr No fix yet —
Ubuntu Pro 18.04 LTS openexr No fix yet —
Ubuntu Pro 16.04 LTS openexr No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-OpenEXR 3.4.16-1.1 openSUSE-SU-2026:12184-1

Advisories 1

References