CVE-2026-68516: OpenEXR HTJ2K Decoder DOS Vulnerability

CVE-2026-68516 Overview

CVE-2026-68516 is a stack-based out-of-bounds write vulnerability [CWE-121] in OpenEXR, the reference implementation of the EXR image format used throughout the motion picture industry. The flaw affects OpenEXR versions 3.4.0 through 3.4.13 and resides in the HTJ2K decompression path that relies on the vendored OpenJPH AVX2 decoder. A crafted HTJ2K-compressed EXR file with malformed JPEG 2000 SIZ geometry can crash the decoder during normal file processing. The vulnerability is fixed in OpenEXR 3.4.14.

Critical Impact
Attackers can trigger denial of service in any application that opens attacker-supplied EXR files through OpenEXR, including rendering pipelines, compositing tools, and asset ingest workflows.

Affected Products

OpenEXR 3.4.0 through 3.4.13
Applications and pipelines that link against affected OpenEXR versions
Vendored OpenJPH AVX2 decoder shipped with affected OpenEXR builds

Discovery Timeline

2026-08-24 - CVE-2026-68516 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-68516

Vulnerability Analysis

OpenEXR added an HTJ2K (High-Throughput JPEG 2000) compression path that delegates codestream decoding to a vendored copy of the OpenJPH library. During decode, OpenEXR validates that the decoded codestream dimensions match the EXR chunk size. This check does not extend to the JPEG 2000 SIZ marker fields that describe the image offset and tile grid geometry.

When the SIZ marker declares that the first tile does not intersect the visible image area, OpenJPH's AVX2 decoder computes tile and codeblock coordinates from these values. The resulting geometry is invalid, producing negative or wrap-around indices that drive a stack buffer write outside the intended bounds. The write terminates the decoder process, causing denial of service in any host application.

Root Cause

The root cause is missing validation in OpenEXR's HTJ2K wrapper. The wrapper checks decoded output dimensions but does not reject SIZ image offset and tile grid values that place tile zero outside the image extents. The downstream OpenJPH AVX2 routines assume tiles intersect the image and write to fixed-size stack buffers based on the untrusted geometry.

Attack Vector

Exploitation requires an attacker to deliver a crafted EXR file and have a victim decode it. This maps to file-processing attack surfaces such as web asset uploads, render farm ingestion, texture pipelines, and desktop viewers. No authentication or elevated privileges are required, and the corrupted SIZ fields fit inside the standard JPEG 2000 codestream carried by the EXR container.

text

// Security patch: bump vendored OpenJPH to 0.31.0
// external/OpenJPH/CMakeLists.txt
 option(OJPH_BUILD_EXECUTABLES "Enables building command line executables" ON)
 option(OJPH_BUILD_STREAM_EXPAND "Enables building ojph_stream_expand executable" OFF)
 option(OJPH_INSTALL "Install OpenJPH libraries, headers, and CMake config" ON)
+option(OJPH_BUILD_FUZZER "Enables building oss-fuzzing target executable" OFF)

 option(OJPH_DISABLE_SIMD "Disables the use of SIMD instructions -- agnostic to architectures" OFF)
 option(OJPH_DISABLE_SSE "Disables the use of SSE SIMD instructions and associated files" OFF)

Source: GitHub Commit #85009d8

Detection Methods for CVE-2026-68516

Indicators of Compromise

Unexpected crashes in processes that link OpenEXR when opening user-supplied .exr files
Stack corruption or SIGSEGV signatures inside the vendored OpenJPH AVX2 decoder module
EXR files whose embedded JPEG 2000 SIZ marker places the first tile outside the image area

Detection Strategies

Inventory installed OpenEXR versions across build machines, render nodes, and workstations and flag versions 3.4.0 through 3.4.13
Scan container images and third-party software packages for bundled OpenEXR libraries in the vulnerable range
Parse incoming EXR files at the ingestion boundary and reject codestreams whose SIZ tile grid does not intersect the image canvas

Monitoring Recommendations

Alert on repeated crashes of media processing services, especially those exposing file upload endpoints
Monitor endpoint telemetry for abnormal termination of DCC applications, render workers, or thumbnail generators handling EXR files
Track file provenance for EXR assets sourced from untrusted collaborators or web submissions

How to Mitigate CVE-2026-68516

Immediate Actions Required

Upgrade OpenEXR to version 3.4.14 or later on all systems that decode EXR files
Rebuild and redeploy internal tools and containers that statically link OpenEXR from the vulnerable range
Restrict EXR ingestion to trusted sources until the upgrade is complete

Patch Information

The issue is fixed in OpenEXR 3.4.14. The fix bumps the vendored OpenJPH library to 0.31.0, which contains hardened tile and codeblock geometry handling in the AVX2 decoder. Refer to GitHub Security Advisory GHSA-fw66-6xph-56jm and the tracking commits #45521f9 and #85009d8.

Workarounds

Disable HTJ2K decompression in EXR processing tools where the configuration is exposed
Sandbox EXR decoders in isolated processes so a crash does not affect the parent pipeline
Pre-validate EXR files with a tool that inspects the JPEG 2000 SIZ marker and rejects tile grids that fall outside image bounds

bash

# Verify installed OpenEXR version and upgrade if vulnerable
pkg-config --modversion OpenEXR

# Example upgrade paths
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade libopenexr-dev

# From source
git clone https://github.com/AcademySoftwareFoundation/openexr.git
cd openexr && git checkout v3.4.14
cmake -B build -S . && cmake --build build --target install