CVE-2026-45696 OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS)
A heap buffer over-read in the OpenEXR HTJ2K decoder allows attackers to cause a crash or leak memory by providing a crafted EXR file.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45696?
CVE-2026-45696 is a high-severity memory corruption vulnerability in Openexr Openexr, published on 18 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, the HTJ2K (High-Throughput JPEG 2000) decoder, ht_undo_impl() in OpenEXRCore is vulnerable to a heap-buffer-overflow READ. The ht_undo_imp function copies decoded pixels out of a per-line OpenJPH buffer using the EXR channel's declared width as the iteration count. The codestream embedded in the EXR chunk can declare different (smaller) tile/line dimensions than the EXR header advertises, but ht_undo_impl() does not validate this — it pulls width 32-bit samples from cur_line->i32[] without checking the OpenJPH line buffer's actual length. A crafted EXR file produces a 4-byte heap-buffer-overflow READ immediately after a buffer allocated by ojph::local::codestream::finalize_alloc(). The bug is reachable through the standard scanline-decode entry point used by every consumer of exr_decoding_run/Imf::checkOpenEXRFile, including thumbnailers, asset pipelines, and the exrcheck utility — i.e. any application that opens untrusted EXR files. The result is a deterministic crash (DoS) and potential adjacent-heap leak. This issue has been fixed in version 3.4.12.
Which versions are affected by CVE-2026-45696?
It affects 1 product.
Products include Openexr Openexr.
How do I fix CVE-2026-45696?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-45696 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45696 exists.
Other vulnerabilities in Openexr Openexr
- CVE-2023-5841 OpenEXR Heap Overflow in Scanline Deep Data Parsing
- CVE-2026-41142 OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
- CVE-2026-42216 OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
- CVE-2017-9111 OpenEXR invalid write
- CVE-2017-9113 Memory corruption in n/a
Sources
Also known as BELL-CVE-2026-45696, DEBIAN-CVE-2026-45696, GHSA-gjpj-qv64-vwhf, JLSEC-2026-813, UBUNTU-CVE-2026-45696.