{"apiVersion":"1.0","identifier":"CVE-2026-68516","description":"OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR-s HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.","publishedAt":"2026-08-24T22:17:19","lastModifiedAt":"2026-08-25T15:16:37","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68516","cvssScore":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","epssProbability":0.00247,"riskScore":0.66,"affectedProduct":"OpenEXR","affectedVersions":">=3.4.0,<=3.4.13","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-68516","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-68516","en":"https://www.redsauce.net/en/cves/CVE-2026-68516","fr":"https://www.redsauce.net/fr/cves/CVE-2026-68516","pt":"https://www.redsauce.net/pt/cves/CVE-2026-68516","de":"https://www.redsauce.net/de/cves/CVE-2026-68516","sk":"https://www.redsauce.net/sk/cves/CVE-2026-68516","el":"https://www.redsauce.net/el/cves/CVE-2026-68516"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-68516"}}