CVE-2026-68516

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.4.0 through 3.4.13

Description OpenEXR is the reference implementation and specification for the EXR image format. A crafted HTJ2K-compressed EXR image can cause a crash during the normal decode process. This occurs when the JPEG 2000 SIZ fields place the first tile outside the visible image, leading to invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder. This results in a stack out-of-bounds write, which leads to a denial of service. While the HTJ2K path validates decoded codestream dimensions against the EXR chunk size, it fails to reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image.

Recommendations Update to version 3.4.14.