Openexr EUVD-2026-18062

Victim must open a crafted .exr file with HTJ2K compression and 32768-pixel channel width in any application using OpenEXR versions 3.4.0-3.4.6. Affects local systems; remote exploitation requires social engineering to deliver the malicious file.

The CVSS 4.0 score of 8.4 with vector AV:L/AC:L/PR:N/UI:A indicates high severity with local attack vector, low complexity, no privileges required, but mandatory user interaction. While the High confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) suggest complete system compromise potential, the local attack vector and user interaction requirements significantly constrain real-world exploitation compared to network-exploitable vulnerabilities. Attackers must convince users to open weaponized .exr files, limiting attack scenarios to social engineering, watering hole attacks targeting media professionals, or supply chain compromise of image assets. The availability of detailed technical information in GitHub commit 3827998f5c041d6a94c6af24bbb363daa669e4b3 and security advisory GHSA-ghfj-fx47-wg97 lowers the barrier for exploit development, though no public exploit identified at time of analysis. Primary risk exists in environments processing untrusted EXR files from external sources-visual effects studios, rendering farms, automated image processing pipelines. The controlled write primitive and RCE potential elevate this above typical parsing bugs, warranting priority remediation despite the local attack vector. Organizations not processing external EXR content face lower immediate risk.

An attacker crafts a malicious .exr image file with HTJ2K compression and channel width set to 32768 pixels, embedding carefully structured metadata to control heap overflow behavior. The weaponized file is distributed through legitimate channels-emailed as a visual effects asset to post-production studios, uploaded to stock image repositories, or embedded in project file archives. When a visual effects artist or automated rendering pipeline opens the file using vulnerable OpenEXR 3.4.0-3.4.6, the HTJ2K decompressor triggers the heap overflow, writing attacker-controlled data beyond buffer boundaries in 2-4 byte increments. With sufficient overflow iterations, the attacker overwrites critical heap structures or adjacent objects to redirect execution flow, achieving arbitrary code execution in the context of the application processing the image. No public exploit identified at time of analysis, but detailed technical disclosure lowers exploitation barriers for sophisticated threat actors.