CVE-2026-65979
Received Received - Intake

Heap-based Buffer Overflow in OpenEXR HTJ2K Decoder

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field (PLEN) from a chunk's compressed data but never checks that this value fits within the available buffer before using it. When decoding, it advances the codestream pointer by the attacker-supplied header size and passes the resulting offset and remaining length to the OpenJPH memory-input path, so a crafted value pushes the pointer past the end of the buffer and causes an out-of-bounds read. Because this field comes straight from attacker-controlled EXR chunk data, the flaw is reachable during normal decoding of an untrusted file. This issue is fixed in version 3.4.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-26
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-65979
EUVD
EUVD-2026-65734

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
academysoftwarefoundation openexr From 3.4.0 (inc) to 3.4.12 (inc)
academysoftwarefoundation openexr 3.4.13
openexr openexr From 3.4.0 (inc) to 3.4.12 (inc)
openexr openexr 3.4.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read flaw in OpenEXR's HTJ2K decoder. It occurs when the decoder parses a header-length field from compressed data without validating if it fits within the available buffer. An attacker can exploit this by providing a crafted value that pushes the pointer past the buffer's end, leading to memory corruption during file decoding.

Detection Guidance

This vulnerability can be detected by checking the installed version of OpenEXR. If the version is between 3.4.0 and 3.4.12, the system is vulnerable. Run 'openexr --version' or check package managers like 'apt list --installed | grep openexr' or 'rpm -qa | grep openexr'.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by tricking a user into opening a maliciously crafted EXR image file. Since the flaw is reachable during normal decoding, any application using the vulnerable OpenEXR versions could be affected.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA if exploited to access or expose sensitive data during image processing. An out-of-bounds read might allow unauthorized access to memory containing personal or health information, violating data protection requirements. However, the described issue primarily causes denial of service rather than data exposure.

Mitigation Strategies

Upgrade OpenEXR to version 3.4.13 or later immediately. Disable or restrict access to applications that process EXR files until the update is applied. Monitor for suspicious activity in systems handling EXR files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65979. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart