Integer overflow in OpenEXR - CVE-2026-39886

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to signed integer overflow in ht_undo_impl() in src/lib/OpenEXRCore/internal_ht.cpp when processing a crafted HTJ2K-compressed EXR file. A remote attacker can supply a specially crafted EXR file to cause a denial of service.

On allocator-permissive hosts, the wrapped negative bytes-per-line value may be used as a per-scanline pointer advance, which could lead to a heap out-of-bounds write.

Affected software

How to mitigate CVE-2026-39886

External References

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-r3mr-mx8q-jcw5

Related Security Bulletins

• Multiple vulnerabilities in OpenEXR
• Anolis OS update for OpenEXR