CVE-2026-39886 - Vulnerability Analysis

Overview

OpenEXR 3.4.0 through 3.4.9 contains a signed integer overflow caused by unchecked accumulation of bytes-per-line in HTJ2K decompression, letting attackers cause heap out-of-bounds write via crafted EXR files, exploit requires crafted file with specific channel and width values.

Severity & Score

Impact

Attackers can cause heap out-of-bounds write, potentially leading to memory corruption or code execution.

Mitigation

Update to version 3.4.10 or later.

References

• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.10
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-r3mr-mx8q-jcw5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner