CVE-2026-54920: OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abort in any application that calls exrstartread() on untrusted input, resulting in denial of service. The crash is triggered by a QCD marker whose lower five bits are zero, which OpenEXR passes into the vendored OpenJPH library while constructing the codestream and evaluating its quantization delta parameters. OpenJPH uses an assertion rather than a recoverable error to validate those bits, so any invalid value calls abort() directly and cannot be intercepted by surrounding error handling, a problem compounded by OpenEXR wrapping only its internal HT header parser in error handling while leaving the later codestream read and construction calls unprotected. This issue has been resolved in version 3.4.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXR (exr_start_read / HTJ2K decode path)to a version that resolves this vulnerability.Fixed in 3.4.13
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using OpenEXR versions 3.4.0 through 3.4.12 are exposed if they call exr_start_read() on untrusted EXR files that may contain HTJ2K-compressed image data.
What must an attacker provide to trigger the denial of service?
An attacker must supply a crafted HTJ2K-compressed EXR file containing a QCD marker whose lower five bits are zero. Processing the file reaches an OpenJPH assertion that calls abort() unconditionally.
Can application error handling prevent the crash?
No. The failing OpenJPH assertion aborts the process directly and cannot be intercepted by surrounding error handling; OpenEXR also does not protect the later codestream read and construction calls involved in this path.
What is the remediation?
Update OpenEXR to version 3.4.13, where the issue is resolved.
How might an affected deployment appear at runtime?
A vulnerable application can terminate abruptly while reading a crafted HTJ2K-compressed EXR through exr_start_read(). The described failure is an assertion-triggered process abort in the HTJ2K decode path.