CVE-2026-54920

OpenEXR (reference implementation for the EXR image format, widely used in the motion picture industry) versions 3.4.0 through 3.4.12 contain a denial of service vulnerability in the HTJ2K decode path . A crafted HTJ2K-compressed EXR file with a QCD marker whose lower five bits are zero is passed...