Buffer overflow in Academysoftwarefoundation Openexr
CVE-2026-44663
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, an integer overflow in ht_undo_impl() in src/lib/OpenEXRCore/internal_ht.cpp leads to a heap-buffer overflow when decoding a crafted HTJ2K-compressed EXR file. decode->channels[i].width (int32_t) is multiplied by bytes_per_element in 32-bit signed arithmetic. With large widths (e.g., >= 536870912 for FLOAT data), this overflows, producing a corrupted offset that is later used for pointer arithmetic and can cause a heap out-of-bounds write. The same unchecked multiplication pattern appears in two other HTJ2K paths (bytes-per-line accumulation and pixel-line pointer advancement). As with related CVE-2026-34378 through CVE-2026-34589 fixes in other codecs, validating only after the multiplication is too late because the value may already be overflowed. This issue has been fixed in version 3.4.12.
Vulnerability class: Integer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H.
EPSS exploit prediction
EPSS: 0.002 (10.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 10.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Academysoftwarefoundation Openexr — versions >= 3.4.0, < 3.4.11
- Openexr
Weakness classification (CWE)
References
- github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-777r-f9x8… (Exploit, Patch, Mitigation, Vendor Advisory)
- github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.12 (Release Notes)
Frequently asked questions
- What is CVE-2026-44663?
- CVE-2026-44663 is a medium-severity vulnerability in Academysoftwarefoundation Openexr, classified under Integer Overflow or Wraparound. CVSS score: 6.1/10. Published 2026-06-18.
- How severe is CVE-2026-44663?
- Medium severity. CVSS v3 base score is 6.1 out of 10.