CVE-2026-68516

Received Received - Intake

Heap Overflow in OpenEXR HTJ2K Decoder

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: GitHub, Inc.

Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-68516

Affected Vendors & Products

Vendor	Product	Version / Range
openexr	openexr	From 3.4.0 (inc) to 3.4.13 (inc)
openexr	openexr	3.4.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability affects OpenEXR versions 3.4.0 through 3.4.13. A crafted HTJ2K-compressed EXR file can crash the software during normal decoding. The issue occurs when JPEG 2000 SIZ fields place the first tile outside the visible image, leading to invalid tile and codeblock geometry in the OpenJPH AVX2 decoder. This causes a stack out-of-bounds write, resulting in a denial of service.

Detection Guidance

This vulnerability affects OpenEXR versions 3.4.0 through 3.4.13. To detect it, check the installed version of OpenEXR using commands like 'openexr --version' or 'dpkg -l | grep openexr' on Linux. If the version is within the affected range, the system is vulnerable.

Impact Analysis

If you use OpenEXR versions 3.4.0 to 3.4.13, an attacker could exploit this vulnerability by providing a specially crafted EXR file. This could crash your application, disrupting normal operations and potentially causing data processing delays or loss.

Mitigation Strategies

Upgrade OpenEXR to version 3.4.14 or later immediately. This version includes a fix for the HTJ2K tile geometry validation issue. If upgrading is not possible, disable HTJ2K decoding or restrict processing of HTJ2K-compressed EXR files until patched.

Hi! I’m here to help you understand CVE-2026-68516. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70