Medium Severity Threats

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an infinite-loop vulnerability in SampleCountChannel. The helper roundListSizeUp() rounds a sample-list size up to the next power of two using repeated unsigned left shifts, which terminates for normal values but fails for UINT_MAX: the sequence reaches 0x80000000, and the next left shift wraps the 32-bit value to 0. Because 0 remains less than UINT_MAX, the loop never progresses and never exits. The bug is reachable through public OpenEXRUtil APIs, either by editing the sample-count buffer through SampleCountChannel::Edit (whose destructor calls endEdit()) or by calling SampleCountChannel::set(x, y, UINT_MAX) on a valid pixel. This issue has been fixed in versions 3.2.10, 3.3.12, and 3.4.13.

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero. When a caller supplies a positive hint_length together with a NULL type_hint, exr_attr_bytes_create() allocates a destination type-hint buffer and then copies from the NULL source pointer, causing a deterministic crash. The flaw is reachable through the public OpenEXRCore C API and results in a denial of service. The issue is fixed in version 3.4.13.

OpenEXR versions prior to 3.2.10, 3.3.12, and 3.4.13 contain a heap out-of-bounds write vulnerability in the SampleCountChannel::set function. This occurs because the Y coordinate is incorrectly computed using dataWindow.min.x instead of dataWindow.min.y, leading to potential heap corruption and process crashes when handling deep image data windows where min.x differs from min.y. The issue is reachable via the public DeepImage API and has been fixed in the specified versions.

A vulnerability in OpenEXR versions 3.4.0 through 3.4.12 allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abort when exr_start_read() is called on untrusted input. This results in a denial of service due to an assertion failure triggered by a specific QCD marker value. The issue arises from the OpenJPH library's use of an assertion that calls abort() directly, bypassing error handling. The vulnerability is fixed in version 3.4.13.

ThreatFox IOCs for 2026-08-24

OpenEXR versions 3.4.0 through 3.4.13 contain an out-of-bounds write vulnerability in the HTJ2K decoder path. A crafted HTJ2K-compressed EXR file with specific JPEG 2000 SIZ fields can cause a stack out-of-bounds write, leading to a denial of service by crashing the application. This occurs because the decoder does not properly reject image-offset/tile-grid geometry where the first tile is outside the visible image. The issue is fixed in version 3.4.14.

CVE-2026-78435 is a path traversal vulnerability in Faveo Helpdesk versions 2.0.0 through 2.0.3. It affects the unlink function in the Logo Handler component, allowing remote attackers to manipulate the argument data1 to perform path traversal. The vulnerability has been publicly disclosed, but no official patch or vendor response is available yet. The CVSS 4.0 score rates this as a medium severity issue.

CVE-2026-78434 is a medium severity vulnerability in Faveo Helpdesk versions 2.0.0 through 2.0.3. It affects the post_ticket_reply function in the FormController component, allowing remote attackers to bypass authentication. The vulnerability has a published exploit, but the vendor has not yet responded or provided a fix.

CVE-2026-78266 is a medium severity vulnerability in AutomatorWP versions up to 5.8.3 involving missing authorization (CWE-862). It allows subscribers to bypass intended access controls, potentially leading to unauthorized actions that impact integrity without affecting confidentiality or availability.

CVE-2026-27364 is a medium severity vulnerability in AnalogWP Style Kits affecting versions up to 2.6.5. It involves missing authorization controls (CWE-862) that allow subscribers to perform unauthorized actions. The vulnerability does not impact confidentiality or availability but can lead to integrity issues. No official patch or remediation guidance is currently available.