OpenEXR CVE-2026-68516

Exploitation requires that the target system runs OpenEXR version 3.4.0 through 3.4.13 with HTJ2K compression support compiled in - this code path was introduced in 3.4.0 and is not present in earlier versions. The crafted file must be processed through the HTJ2K decode path specifically; EXR files using other compression types do not trigger the vulnerable code. The CVSS UI:R metric indicates a user or automated process must open and attempt to decode the file. Limiting factors include: the need to deliver a file to a decoding context, the UI:R interaction requirement reducing automatable mass exploitation, and the impact being limited to process crash with no code execution or data exposure. Systems that do not process HTJ2K-compressed EXR files, or that pre-filter EXR compression attributes before decoding, are not exposed.

The CVSS 6.5 score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H is consistent with the described attack model: network delivery of a malicious file with no authentication required, but a user or automated process must trigger the decode. The UI:R factor meaningfully constrains opportunistic mass exploitation; however, media ingestion pipelines, render farms, and digital content creation tooling that automatically process incoming EXR assets may fulfill this requirement without explicit user interaction, reducing the practical barrier. No EPSS score was provided in the input data, and the CVE does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis. Impact is strictly a denial of service - the stack corruption crashes the decoding process with no confidentiality or integrity consequence reported. The combination of no KEV listing, no POC, UI:R, and availability-only impact suggests this is a medium-priority patch item for most organizations, though studios and post-production facilities with automated EXR ingest pipelines should prioritize the upgrade to 3.4.14 promptly given their attack surface.

An attacker crafts a malicious EXR file with a JPEG 2000 SIZ marker that specifies a tile-grid offset placing the first tile entirely outside the visible image canvas, then delivers it to a target user or automated media ingestion pipeline running OpenEXR 3.4.0-3.4.13. When the HTJ2K code path in the OpenJPH AVX2 decoder processes the file, it computes invalid tile and codeblock geometry and performs a stack out-of-bounds write, crashing the host application. No public proof-of-concept exploit has been identified, but the attack surface is file delivery to any system that decodes HTJ2K-compressed EXR input.