By vendor

Openexr vulnerabilities

Known CVEs affecting Openexr products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-45696MEDIUM 6.5

  OpenEXR, the industry-standard image format for motion pictures, contains a flaw in its HTJ2K decoder that allows a maliciously crafted EXR file to crash any application that opens it. When processing the file, the decoder incorrectly trusts the declared image dimensions without validating them against the actual data buffer, causing it to read beyond allocated memory. Any tool that previews, validates, or processes EXR files—including thumbnail generators, asset management systems, and the exrcheck utility—is at risk. This affects versions 3.4.0 through 3.4.11.

• CVE-2026-44663MEDIUM 6.1

  OpenEXR versions 3.4.0 through 3.4.11 contain a flaw in how they process HTJ2K-compressed EXR image files. When decoding a specially crafted file, an integer overflow occurs during calculation of image channel dimensions, resulting in an incorrect memory address. This address is then used to write data to the heap, potentially overwriting adjacent memory. An attacker could exploit this by distributing a malicious EXR file; a user opening it in affected software could experience a crash or, in principle, allow code execution, though the latter is not confirmed. The vulnerability has been patched in version 3.4.12.