CVE-2026-53532

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.4.0 through 3.4.12

Description A crafted HTJ2K-compressed EXR file can cause an unconditional process abort, leading to a denial of service in applications that call the exr start read() function on untrusted input. The issue occurs when a QCD marker with its lower five bits set to zero is passed to the vendored OpenJPH library during codestream construction and quantization delta parameter evaluation. OpenJPH utilizes an assertion instead of a recoverable error to validate these bits, triggering a direct call to abort() that bypasses surrounding error handling. This is further exacerbated by the fact that only the internal HT header parser is wrapped in error handling, leaving subsequent codestream read and construction calls unprotected.

Recommendations Update to version 3.4.13.