Denial of Service Vulnerability in OpenEXR by Academy Software Foundation
CVE-2026-53532

7.1HIGH

Key Information:

Vendor

Academysoftwarefoundation

Status
Openexr
Vendor
CVE Published:
24 August 2026

What is CVE-2026-53532?

OpenEXR, a widely used image format in the motion picture industry, suffers from a denial of service vulnerability in versions 3.4.0 through 3.4.12. This vulnerability can be exploited by a specially crafted HTJ2K-compressed EXR file, causing applications to crash unexpectedly when calling exr_start_read() with untrusted input. The root cause lies in the way OpenEXR processes QCD markers, where invalid lower bits result in an unconditional abort due to assertions in the vendored OpenJPH library. This lack of proper error handling can lead to significant disruptions, making it essential for users to upgrade to version 3.4.13, which mitigates the issue.

Affected Version(s)

openexr >= 3.4.0, < 3.4.13

References

https://github.com/AcademySoftwareFoundation/openexr/secu...
x_refsource_CONFIRM
https://github.com/AcademySoftwareFoundation/openexr/rele...
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.