CVE-2026-44663

OpenEXR CVE-2026-44663 is a heap-buffer overflow in the HTJ2K decoder (ht_undo_impl) caused by 32-bit signed overflow when multiplying decode->channels[i].width by bytes_per_element during HTJ2K decoding. This occurs in OpenEXR 3.4.0–3.4.11 and can lead to a heap out-of-bounds write when handl...