CVE-2026-44663: CWE-190: Integer Overflow or Wraparound in AcademySoftwareFoundation openexr
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, an integer overflow in ht_undo_impl() in src/lib/OpenEXRCore/internal_ht.cpp leads to a heap-buffer overflow when decoding a crafted HTJ2K-compressed EXR file. decode->channels[i].width (int32_t) is multiplied by bytes_per_element in 32-bit signed arithmetic. With large widths (e.g., >= 536870912 for FLOAT data), this overflows, producing a corrupted offset that is later used for pointer arithmetic and can cause a heap out-of-bounds write. The same unchecked multiplication pattern appears in two other HTJ2K paths (bytes-per-line accumulation and pixel-line pointer advancement). As with related CVE-2026-34378 through CVE-2026-34589 fixes in other codecs, validating only after the multiplication is too late because the value may already be overflowed. This issue has been fixed in version 3.4.12.
AI Analysis
Technical Summary
The vulnerability in openexr (CVE-2026-44663) involves an integer overflow in the ht_undo_impl() function within src/lib/OpenEXRCore/internal_ht.cpp. Specifically, decode->channels[i].width (int32_t) is multiplied by bytes_per_element using 32-bit signed arithmetic. For large width values (e.g., >= 536870912 for FLOAT data), this multiplication overflows, resulting in a corrupted offset used later for pointer arithmetic, causing a heap-buffer overflow. Similar unchecked multiplications occur in other HTJ2K decoding paths. The flaw affects versions 3.4.0 through 3.4.11 and was fixed in 3.4.12.
Potential Impact
This vulnerability can lead to a heap-buffer overflow during decoding of crafted HTJ2K-compressed EXR files, potentially causing a heap out-of-bounds write. The CVSS score of 6.1 indicates a medium severity with local attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.
Mitigation Recommendations
A fix is available in openexr version 3.4.12. Users should upgrade to version 3.4.12 or later to remediate this vulnerability. There is no indication of alternative mitigations or temporary fixes.
CVE-2026-44663: CWE-190: Integer Overflow or Wraparound in AcademySoftwareFoundation openexr
Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, an integer overflow in ht_undo_impl() in src/lib/OpenEXRCore/internal_ht.cpp leads to a heap-buffer overflow when decoding a crafted HTJ2K-compressed EXR file. decode->channels[i].width (int32_t) is multiplied by bytes_per_element in 32-bit signed arithmetic. With large widths (e.g., >= 536870912 for FLOAT data), this overflows, producing a corrupted offset that is later used for pointer arithmetic and can cause a heap out-of-bounds write. The same unchecked multiplication pattern appears in two other HTJ2K paths (bytes-per-line accumulation and pixel-line pointer advancement). As with related CVE-2026-34378 through CVE-2026-34589 fixes in other codecs, validating only after the multiplication is too late because the value may already be overflowed. This issue has been fixed in version 3.4.12.
CVSS v3.1
Score 6.1medium
Affected software
pkg:github/academysoftwarefoundation/openexrRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in openexr (CVE-2026-44663) involves an integer overflow in the ht_undo_impl() function within src/lib/OpenEXRCore/internal_ht.cpp. Specifically, decode->channels[i].width (int32_t) is multiplied by bytes_per_element using 32-bit signed arithmetic. For large width values (e.g., >= 536870912 for FLOAT data), this multiplication overflows, resulting in a corrupted offset used later for pointer arithmetic, causing a heap-buffer overflow. Similar unchecked multiplications occur in other HTJ2K decoding paths. The flaw affects versions 3.4.0 through 3.4.11 and was fixed in 3.4.12.
Potential Impact
This vulnerability can lead to a heap-buffer overflow during decoding of crafted HTJ2K-compressed EXR files, potentially causing a heap out-of-bounds write. The CVSS score of 6.1 indicates a medium severity with local attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.
Mitigation Recommendations
A fix is available in openexr version 3.4.12. Users should upgrade to version 3.4.12 or later to remediate this vulnerability. There is no indication of alternative mitigations or temporary fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-07T16:20:08.659Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3456d1f198dc38c18207de
Added to database: 06/18/2026, 20:36:33 UTC
Last enriched: 06/25/2026, 21:15:11 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 102
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.