CVE-2026-54920

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abort in any application that calls exr_start_read() on untrusted input, resulting in denial of service. The crash is triggered by a QCD marker whose lower five bits are zero, which OpenEXR passes into the vendored OpenJPH library while constructing the codestream and evaluating its quantization delta parameters. OpenJPH uses an assertion rather than a recoverable error to validate those bits, so any invalid value calls abort() directly and cannot be intercepted by surrounding error handling, a problem compounded by OpenEXR wrapping only its internal HT header parser in error handling while leaving the later codestream read and construction calls unprotected. This issue has been resolved in version 3.4.13.

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abort in any application that calls exr_start_read() on untrusted input, resulting in denial of service. The crash is triggered by a QCD marker whose lower five bits are zero, which OpenEXR passes into the vendored OpenJPH library while constructing the codestream and evaluating its quantization delta parameters. OpenJPH uses an assertion rather than a recoverable error to validate those bits, so any invalid value calls abort() directly and cannot be intercepted by surrounding error handling, a problem compounded by OpenEXR wrapping only its internal HT header parser in error handling while leaving the later codestream read and construction calls unprotected. This issue has been resolved in version 3.4.13.

• CVE-2026-54920: validate the data window and pre-initialise every level pointer in OpenEXRUtil Image::resize(), so an overflowing level size no longer leaves clearLevels() deleting uninitialised ImageLevel pointers
• CVE-2026-55059: map the row index with dataWindow.min.y instead of min.x in SampleCountChannel::set(int, unsigned int[]) and bounds-check the per-pixel setter, so a valid row no longer writes before the sample-count buffer
• CVE-2026-55373: reject sample counts above 0x80000000 in roundListSizeUp(), so the unsigned shift loop can no longer wrap to zero and spin forever
• CVE-2026-59183: widen the chunk width, height and row index to int64_t in unpack_sample_table(), so a large deep tile no longer overflows the sample-table index arithmetic and reads unmapped memory
• CVE-2026-59184: index the TypedFlatImageChannel row() accessors from the compact _pixels array instead of the absolute-coordinate _base pointer, so writing rows of an image with a non-zero data window origin no longer writes outside the pixel buffer
• CVE-2026-59186: validate Array/Array2D dimensions and compute the Array2D element count in 64-bit arithmetic, so an oversized tile no longer under-allocates the Rgba conversion buffer on ILP32 builds
• CVE-2026-59189: index the TypedDeepImageChannel row() accessors from the compact _sampleListPointers array instead of the absolute-coordinate _base pointer, so reading rows of a deep image with a non-zero data window origin no longer reads outside the sample-list pointer buffer
• CVE-2026-59981: index SampleCountChannel::row() from the compact _numSamples array instead of the absolute-coordinate _base pointer, so row(0) stays inside the allocation for a deep image with a non-zero data window origin
• CVE-2026-59983: compute the deep sample-count table size in uint64_t and reject a truncating conversion in update_pack_unpack_ptrs(), so an ILP32 build no longer allocates a wrapped-to-zero table
• CVE-2026-59984: reject a scratch-buffer size that does not survive the conversion to size_t in internal_exr_undo_b44() and internal_exr_undo_b44a(), so B44/B44A decode no longer writes past a truncated ILP32 allocation
• CVE-2026-61555: return defaultViewName() instead of multiView[0] in viewFromChannelName(), so a crafted empty multiView attribute no longer indexes an empty vector

• CVE-2026-54920: validate the data window and pre-initialise every level pointer in OpenEXRUtil Image::resize(), so an overflowing level size no longer leaves clearLevels() deleting uninitialised ImageLevel pointers
• CVE-2026-55059: map the row index with dataWindow.min.y instead of min.x in SampleCountChannel::set(int, unsigned int[]) and bounds-check the per-pixel setter, so a valid row no longer writes before the sample-count buffer
• CVE-2026-55373: reject sample counts above 0x80000000 in roundListSizeUp(), so the unsigned shift loop can no longer wrap to zero and spin forever
• CVE-2026-59183: widen the chunk width, height and row index to int64_t in unpack_sample_table(), so a large deep tile no longer overflows the sample-table index arithmetic and reads unmapped memory
• CVE-2026-59184: index the TypedFlatImageChannel row() accessors from the compact _pixels array instead of the absolute-coordinate _base pointer, so writing rows of an image with a non-zero data window origin no longer writes outside the pixel buffer
• CVE-2026-59186: validate Array/Array2D dimensions and compute the Array2D element count in 64-bit arithmetic, so an oversized tile no longer under-allocates the Rgba conversion buffer on ILP32 builds
• CVE-2026-59189: index the TypedDeepImageChannel row() accessors from the compact _sampleListPointers array instead of the absolute-coordinate _base pointer, so reading rows of a deep image with a non-zero data window origin no longer reads outside the sample-list pointer buffer
• CVE-2026-59981: index SampleCountChannel::row() from the compact _numSamples array instead of the absolute-coordinate _base pointer, so row(0) stays inside the allocation for a deep image with a non-zero data window origin
• CVE-2026-59983: compute the deep sample-count table size in uint64_t and reject a truncating conversion in update_pack_unpack_ptrs(), so an ILP32 build no longer allocates a wrapped-to-zero table
• CVE-2026-59984: reject a scratch-buffer size that does not survive the conversion to size_t in internal_exr_undo_b44() and internal_exr_undo_b44a(), so B44/B44A decode no longer writes past a truncated ILP32 allocation
• CVE-2026-61555: return defaultViewName() instead of multiView[0] in viewFromChannelName(), so a crafted empty multiView attribute no longer indexes an empty vector

These are all security issues fixed in the libIex-3_4-33-3.4.13-1.1 package on the GA media of openSUSE Tumbleweed.

This update for openexr fixes the following issues

• CVE-2026-54920: unchecked integer overflows in Image::resize() followed by an exception can lead to an invalid delete via uninitialized pointers (bsc#1269703).
• CVE-2026-55059: row setter utilizing dataWindow.min.x instead of min.y can lead to a heap out-of-bounds write (bsc#1269702).
• CVE-2026-55373: integer overflow in roundListSizeUp() wrapping a 32-bit unsigned value to zero can lead to an infinite loop (bsc#1269701).

This update for openexr fixes the following issues

• CVE-2026-54920: unchecked integer overflows in Image::resize() followed by an exception can lead to an invalid delete via uninitialized pointers (bsc#1269703).
• CVE-2026-55059: row setter utilizing dataWindow.min.x instead of min.y can lead to a heap out-of-bounds write (bsc#1269702).
• CVE-2026-55373: integer overflow in roundListSizeUp() wrapping a 32-bit unsigned value to zero can lead to an infinite loop (bsc#1269701).

This update for openexr fixes the following issue

• CVE-2026-54920: unchecked integer overflows in Image::resize() followed by an exception can lead to an invalid delete via uninitialized pointers (bsc#1269703).

This update for openexr fixes the following issues

• CVE-2026-54920: unchecked integer overflows in Image::resize() followed by an exception can lead to an invalid delete via uninitialized pointers (bsc#1269703).
• CVE-2026-55059: row setter utilizing dataWindow.min.x instead of min.y can lead to a heap out-of-bounds write (bsc#1269702).
• CVE-2026-55373: integer overflow in roundListSizeUp() wrapping a 32-bit unsigned value to zero can lead to an infinite loop (bsc#1269701).