PT-2026-48599 · Openexr · Openexr
CVSS v4.0
8.3
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H |
Name of the Vulnerable Software and Affected Versions
OpenEXR versions 3.4.0 through 3.4.11
Description
The HTJ2K (High-Throughput JPEG 2000) decoder in OpenEXRCore contains a heap-buffer-overflow READ in the
ht undo impl() function. This occurs because the function copies decoded pixels from a per-line OpenJPH buffer using the EXR channel's declared width as the iteration count without validating if the codestream embedded in the EXR chunk has smaller tile or line dimensions than those advertised in the EXR header. Consequently, the function reads 32-bit samples from cur line->i32[] beyond the actual length of the OpenJPH line buffer. A specially crafted EXR file can trigger a 4-byte heap-buffer-overflow READ following a buffer allocated by ojph::local::codestream::finalize alloc(). This issue is reachable via the standard scanline-decode entry point used by any application opening untrusted EXR files, such as thumbnailers, asset pipelines, and the exrcheck utility, leading to a deterministic crash (Denial of Service) and potential adjacent-heap leak.Recommendations
Update to version 3.4.12.
Exploit
Fix
Heap Based Buffer Overflow
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openexr