CVE-2026-65979

Name	CVE-2026-65979
Description	OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field (PLEN) from a chunk's compressed data but never checks that this value fits within the available buffer before using it. When decoding, it advances the codestream pointer by the attacker-supplied header size and passes the resulting offset and remaining length to the OpenJPH memory-input path, so a crafted value pushes the pointer past the end of the buffer and causes an out-of-bounds read. Because this field comes straight from attacker-controlled EXR chunk data, the flaw is reachable during normal decoding of an untrusted file. This issue is fixed in version 3.4.13.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openexr (PTS)	bullseye (security), bullseye	2.5.4-2+deb11u1	fixed
	bookworm	3.1.5-5	fixed
	trixie	3.1.13-2	fixed
	forky	3.4.6+ds-4	vulnerable
	sid	3.4.14-0.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
openexr	source	bullseye	(not affected)
openexr	source	bookworm	(not affected)
openexr	source	trixie	(not affected)
openexr	source	(unstable)	3.4.14-0.1

Notes

[trixie] - openexr <not-affected> (Vulnerable code not present, introduced in 3.4.0)
[bookworm] - openexr <not-affected> (Vulnerable code not present, introduced in 3.4.0)
[bullseye] - openexr <not-affected> (Vulnerable code not present, introduced in 3.4.0)
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3j9c-j7c9-x293
https://github.com/AcademySoftwareFoundation/openexr/commit/c7af2d233b7b2a4452c11f26cf47584cc2b35721 (v3.4.13-rc)
Introduced by: https://github.com/AcademySoftwareFoundation/openexr/commit/50ba96b1dbe353a98a626c7fd0ff1e50cc8c188f (v3.4-alpha)