Vulnerability Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field (PLEN) from a chunk's compressed data but never checks that this value fits within the available buffer before using it. When decoding, it advances the codestream pointer by the attacker-supplied header size and passes the resulting offset and remaining length to the OpenJPH memory-input path, so a crafted value pushes the pointer past the end of the buffer and causes an out-of-bounds read. Because this field comes straight from attacker-controlled EXR chunk data, the flaw is reachable during normal decoding of an untrusted file. This issue is fixed in version 3.4.13.
Related Weaknesses (CWE)
References
- https://github.com/AcademySoftwareFoundation/openexr/commit/c7af2d233b7b2a4452c1
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.13
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3j
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3j
FAQ
What is CVE-2026-65979?
CVE-2026-65979 is a documented vulnerability. OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-len...
How severe is CVE-2026-65979?
CVSS scoring is not yet available for CVE-2026-65979. Check NVD for updates.
Is there a patch for CVE-2026-65979?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.