Python Library OpenEXR 3.4.0 < 3.4.13 DoS (CVE-2026-53532)

The version of the OpenEXR Python package installed on the remote host is 3.4.x prior to 3.4.13. It is, therefore, affected by a denial of service vulnerability: - A crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exrstartread on untrusted...

CVE-2026-65979

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field PLEN from a chunk's compressed data but never checks that this value fits within the...

CVE-2026-65979 OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field PLEN from a chunk's compressed data but never checks that this value fits within the...

CVE-2026-65979

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field PLEN from a chunk's compressed data but never checks that this value fits within the...

CVE-2026-65979

OpenEXR (the reference implementation for the EXR image format, widely used in the motion picture industry) versions 3.4.0 through 3.4.12 contain an out-of-bounds read in the HTJ2K decoder . The decoder parses a header-length field (PLEN ) from a chunk's compressed data and advances the codestrea...

CVE-2026-65979 OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field PLEN from a chunk's compressed data but never checks that this value fits within the...

CVE-2026-68516

A flaw was found in OpenEXR. A remote attacker could provide a specially crafted HTJ2K-compressed EXR image file. When OpenEXR processes this file with JPEG 2000 SIZ fields that place the first tile outside the visible image, it can lead to invalid tile and codeblock geometry. This results in a...

CVE-2026-54920

A flaw was found in OpenEXR. A remote attacker could exploit a reachable assertion failure in the HTJ2K decode path by providing a specially crafted HTJ2K-compressed EXR file. This file, containing a QCD marker with specific invalid bits, causes an unconditional process abort in applications that...

CVE-2026-53532

A flaw was found in OpenEXR. A remote attacker can provide a specially crafted HTJ2K-compressed EXR file, which causes an unconditional process abort in applications that process untrusted input. This denial of service occurs because OpenEXR passes a malformed QCD marker to the vendored OpenJPH...

CVE-2026-54920

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

DEBIAN-CVE-2026-54920

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

EUVD-2026-65182

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

CVE-2026-54920 OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

CVE-2026-54920

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

CVE-2026-54920

OpenEXR (reference implementation for the EXR image format, widely used in the motion picture industry) versions 3.4.0 through 3.4.12 contain a denial of service vulnerability in the HTJ2K decode path . A crafted HTJ2K-compressed EXR file with a QCD marker whose lower five bits are zero is passed...

CVE-2026-54920 OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

UBUNTU-CVE-2026-54920

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

UBUNTU-CVE-2026-68516

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the...

PT-2026-81487

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.4.0 through 3.4.12 Description The HTJ2K decoder fails to verify if the header-length field PLEN parsed from a chunk's compressed data fits within the available buffer. During decoding, the codestream pointer is advanced by...

Linux Distros Unpatched Vulnerability : CVE-2026-54920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12...