Heap-buffer Overflow Vulnerability in OpenEXR by Academy Software Foundation

CVE-2026-44663

What is CVE-2026-44663?

The OpenEXR library, which is pivotal for handling the EXR image format in the motion picture industry, is susceptible to a heap-buffer overflow due to an integer overflow in the ht_undo_impl() function. This vulnerability is present in versions 3.4.0 to 3.4.11 and arises from the mishandling of arithmetic operations when decoding specially crafted HTJ2K-compressed EXR files. Specifically, an unchecked multiplication of channel widths can lead to a corrupted offset, resulting in potential heap out-of-bounds writes. This critical flaw in memory management highlights the need for rigorous validation of input data before processing to prevent exploitation. The issue has been addressed in version 3.4.12.

References