Denial of Service Vulnerability in OpenEXR Software by Academy Software Foundation
CVE-2026-54920

NONE

Key Information:

Vendor

Academysoftwarefoundation

Status
Openexr
Vendor
CVE Published:
25 August 2026

What is CVE-2026-54920?

In versions 3.4.0 to 3.4.12 of OpenEXR, a vulnerability exists that can lead to a denial of service due to a reachable assertion failure in the HTJ2K decoding process. Specifically, when an application calls the exr_start_read() function using crafted HTJ2K-compressed EXR files with a specific QCD marker, it triggers an unconditional abort of the process. This occurs because OpenEXR delegates certain validation to the vendored OpenJPH library, which uses assertions to check conditions rather than allowing for error recovery. The lack of comprehensive error handling for the codestream read and construction calls exacerbates this issue. Users are advised to upgrade to version 3.4.13 or later to mitigate this vulnerability.

Affected Version(s)

openexr < 3.2.10 < 3.2.10

openexr >= 3.3.0, <= 3.3.12 <= 3.3.0, 3.3.12

openexr >= 3.4.0, <= 3.4.13 <= 3.4.0, 3.4.13

References

https://github.com/AcademySoftwareFoundation/openexr/secu...
x_refsource_CONFIRM

CVSS V3.1

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.