CVE-2026-65979: CWE-20: Improper Input Validation in AcademySoftwareFoundation openexr

OpenEXR, a widely used reference implementation for the EXR image format, contains a vulnerability in its HTJ2K decoder from versions 3.4.0 through 3.4.12. The decoder parses a header-length field (PLEN) from a chunk's compressed data but fails to validate that this length fits within the available buffer before use. During decoding, the codestream pointer is advanced by this attacker-supplied header size and passed to the OpenJPH memory-input path, which can cause an out-of-bounds read when the pointer exceeds the buffer boundary. This vulnerability is exploitable by processing crafted EXR files and is addressed in version 3.4.13.

An attacker can craft a malicious EXR file that triggers an out-of-bounds read in the HTJ2K decoder, potentially leading to memory corruption or information disclosure. The vulnerability requires local access to process a malicious file and user interaction (opening the file). There is no indication of remote code execution or privilege escalation from the available data.

Upgrade OpenEXR to version 3.4.13 or later, where this vulnerability has been fixed. No other mitigation or workaround is indicated in the available information.