Service interruption via overflowing HTJ2K scanline stride
Published Apr 21, 2026 · Updated Apr 21, 2026
Integer overflow in OpenEXR 3.4.0 through 3.4.9 allows remote attackers to interrupt decoding via a crafted HTJ2K EXR file. ht_undo_impl accumulates attacker-controlled channel widths into the signed 32-bit bpl stride without a pre-overflow guard, then uses a wrapped value for scanline advancement. Network reachability requires a service that automatically decodes supplied files; ordinary memory limits stop at allocation failure, while a successful roughly 64 GB allocation exposes an inferred heap out-of-bounds write.
Summary
What happened
Integer overflow in OpenEXR 3.4.0 through 3.4.9 allows remote attackers to interrupt decoding via a crafted HTJ2K EXR file. ht_undo_impl accumulates attacker-controlled channel widths into the signed 32-bit bpl stride without a pre-overflow guard, then uses a wrapped value for scanline advancement. Network reachability requires a service that automatically decodes supplied files; ordinary memory limits stop at allocation failure, while a successful roughly 64 GB allocation exposes an inferred heap out-of-bounds write.
The record
- CVE
- CVE-2026-39886
- Published
- Apr 21, 2026
- Updated
- Apr 21, 2026
- Vendor
- Academy Software Foundation
- Product
- OpenEXR
- Classifications
- CWE-680, CWE-190, CWE-787, T1499.004
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Apr 21, 2026CVE publishedPublication date reported by the CVE source.
- Apr 21, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=>= 3.4.0, < 3.4.10
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- HTJ2K bpl overflow UBSan reproducerproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo