CVE-2026-44663 Details
Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, an integer overflow in ht_undo_impl() in src/lib/OpenEXRCore/internal_ht.cpp leads to a heap-buffer overflow when decoding a crafted HTJ2K-compressed EXR file. decode->channels[i].width (int32_t) is multiplied by bytes_per_element in 32-bit signed arithmetic. With large widths (e.g., >= 536870912 for FLOAT data), this overflows, producing a corrupted offset that is later used for pointer arithmetic and can cause a heap out-of-bounds write. The same unchecked multiplication pattern appears in two other HTJ2K paths (bytes-per-line accumulation and pixel-line pointer advancement). As with related CVE-2026-34378 through CVE-2026-34589 fixes in other codecs, validating only after the multiplication is too late because the value may already be overflowed. This issue has been fixed in version 3.4.12.
A heap-buffer overflow vulnerability has been identified in OpenEXR versions 3.4.0 prior to 3.4.11. The issue arises from an integer overflow in the HTJ2K decoder function 'ht_undo_impl()', located in 'src/lib/OpenEXRCore/internal_ht.cpp'. When decoding a specially crafted HTJ2K-compressed EXR file, the decoder improperly calculates channel widths, leading to a signed integer overflow. This overflow creates a corrupted pointer offset that is exploited to write outside the bounds of a heap-allocated buffer, causing a memory corruption vulnerability.
Users can upgrade to OpenEXR version 3.4.12, which addresses this vulnerability by correcting the integer overflow issue. Instructions for downloading this version are available on the OpenEXR GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-777r-f9x8-7r84 | CISA-ADP | ExploitMitigationPatchVendor Advisory |
| https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.12 | [email protected] | Release Notes |
| https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-777r-f9x8-7r84 | [email protected] | ExploitMitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openexr openexr | >= 3.4.0, < 3.4.12 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |