The vulnerability in AcademySoftwareFoundation's openexr (CVE-2026-39886) is a signed integer overflow in the HTJ2K decompression path, specifically in the ht_undo_impl() function in internal_ht.cpp. The 32-bit signed integer accumulator for bytes-per-line (bpl) can overflow when processing a crafted EXR file with 16,385 FLOAT channels at the maximum width of 32,767 pixels. This overflow causes the bpl value to wrap around, resulting in undefined behavior and potentially a heap out-of-bounds write if the host system permits the large memory allocation (~64 GB). This issue is distinct from a previously fixed overflow in the same function and was not addressed in earlier patches. The vulnerability is remediated in openexr version 3.4.10.

The integer overflow can lead to undefined behavior and a heap out-of-bounds write, which may cause application crashes or memory corruption. The impact is limited to denial of service or potential memory corruption but does not affect confidentiality or integrity directly. Exploitation requires a crafted EXR file with extreme parameters and a host system capable of allocating very large memory, making exploitation conditions somewhat constrained.

A fix for this vulnerability is available in openexr version 3.4.10. Users should upgrade to version 3.4.10 or later to remediate this issue. There is no vendor advisory explicitly stating otherwise, so patching is the recommended action. No additional mitigations are specified.