{"id":"CVE-2026-68516","aliases":["BELL-CVE-2026-68516","DEBIAN-CVE-2026-68516","EUVD-2026-65178","GHSA-fw66-6xph-56jm","UBUNTU-CVE-2026-68516","openSUSE-SU-2026:12184-1"],"status":"published","title":"OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00452,"percentile":0.39731,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2026-08-24T22:08:49Z","modified":"2026-11-07T13:00:09Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"openexr","fixed_in":["3.4.15-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openexr","fixed_in":["3.4.14-0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.4-r0"},{"fixed":"3.4.15-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-1","3.1.13-2","3.1.5-5","3.1.5-5.1","3.1.5-5.1+hurd.1","3.4.14-0.1","3.4.15+ds-1","3.4.16+ds-1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4","3.5.2+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.14-0.1"}]}],"versions":["3.1.13-2","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-1ubuntu3","2.2.0-7ubuntu1","2.2.0-9ubuntu1","2.2.0-10ubuntu2","2.2.0-10ubuntu2.1","2.2.0-10ubuntu2.2","2.2.0-10ubuntu2.3","2.2.0-10ubuntu2.4","2.2.0-10ubuntu2.6","2.2.0-10ubuntu2.6+esm1","2.2.0-10ubuntu2.6+esm2","2.2.0-10ubuntu2.6+esm3","2.2.0-10ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-11ubuntu1","2.2.0-11.1ubuntu1","2.2.0-11.1ubuntu1.1","2.2.0-11.1ubuntu1.2","2.2.0-11.1ubuntu1.3","2.2.0-11.1ubuntu1.4","2.2.0-11.1ubuntu1.6","2.2.0-11.1ubuntu1.7","2.2.0-11.1ubuntu1.8","2.2.0-11.1ubuntu1.9","2.2.0-11.1ubuntu1.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-4.1ubuntu1","2.3.0-6","2.3.0-6build1","2.3.0-6ubuntu0.1","2.3.0-6ubuntu0.2","2.3.0-6ubuntu0.3","2.3.0-6ubuntu0.5","2.3.0-6ubuntu0.5+esm1","2.3.0-6ubuntu0.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.4-2","2.5.7-1","2.5.7-1ubuntu0.1~esm1","2.5.7-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.5-5.1","3.1.5-5.1build1","3.1.5-5.1build2","3.1.5-5.1build3","3.1.5-5.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2build1","3.4.6+ds-4ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2","3.1.13-2build1","3.1.13-2ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-OpenEXR","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.16-1.1"}]}],"bundled":17}],"products":[{"vendor":"academysoftwarefoundation","product":"openexr"}],"references":[{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-fw66-6xph-56jm","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/45521f92104373b5c850f27f2d4659ab6759e848","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/85009d840cc085aa96ad03ae76fa6463defeb0e5","tags":["x_refsource_MISC","fix"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-68516","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68516.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68516","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-68516","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-68516","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68516","tags":["report"]},{"url":"https://github.com/academysoftwarefoundation/openexr/commit/45521f92104373b5c850f27f2d4659ab6759e848","tags":["report"]},{"url":"https://github.com/academysoftwarefoundation/openexr/commit/85009d840cc085aa96ad03ae76fa6463defeb0e5","tags":["report"]},{"url":"https://github.com/academysoftwarefoundation/openexr/security/advisories/ghsa-fw66-6xph-56jm","tags":["report"]},{"url":"https://github.com/cveproject/cvelistv5/tree/main/cves/2026/68xxx/cve-2026-68516.json","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/cve-2026-68516","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68516","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-68516","title":"OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.","status":"published","published":"2026-08-24T22:08:49.176Z","modified":"2026-08-25T14:25:11.59Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-787","CWE-121"],"updated_at":"2026-11-02T13:45:59.110885Z"}],"euvd":[{"id":"EUVD-2026-65178","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.","status":"published","published":"2026-08-24T22:08:49Z","modified":"2026-08-25T14:25:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:32.944243Z"}],"nvd":[{"id":"CVE-2026-68516","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.","status":"published","published":"2026-08-24T22:17:19.34Z","modified":"2026-10-12T15:10:00.207Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:12:41.018848Z"}],"osv":[{"id":"BELL-CVE-2026-68516","status":"published","published":"2026-08-27T06:10:26.922246Z","modified":"2026-09-05T07:15:10.589619001Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:25.50888Z"},{"id":"CVE-2026-68516","title":"OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.","status":"published","published":"2026-08-24T22:08:49.176Z","modified":"2026-10-28T02:31:08.204918895Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T15:45:14.808935Z"},{"id":"DEBIAN-CVE-2026-68516","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.","status":"published","published":"2026-08-24T22:17:19.34Z","modified":"2026-11-07T13:00:09.086138486Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T13:16:37.331514Z"},{"id":"UBUNTU-CVE-2026-68516","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.","status":"published","published":"2026-08-24T22:17:00Z","modified":"2026-10-17T13:00:41.750412766Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"openSUSE-SU-2026:12184-1","title":"python313-OpenEXR-3.4.16-1.1 on GA media","description":"These are all security issues fixed in the python313-OpenEXR-3.4.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-18T00:00:00Z","modified":"2026-10-19T09:30:04.174369125Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}