CVE-2026-39886
type: TechArticle
description: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Versions 3.4.0 through 3.4.9 have a signed integer overflow vulnerability in OpenEXR's HTJ2K (High-Throughput JPEG 2000) decompression path. The `ht_undo_impl()` function in `src/lib/OpenEXRCore/internal_ht.cpp` accumulates a bytes-per-line value (`bpl`) using a 32-bit signed integer with no overflow guard. A crafted EXR file with 16,385 FLOAT channels at the HTJ2K maximum width of 32,767 causes `bpl` to overflow `INT_MAX`, producing undefined behavior confirmed by UBSan. On an allocator-permissive host where the required ~64 GB allocation succeeds, the wrapped negative `bpl` value would subsequently be used as a per-scanline pointer advance, which would produce a heap out-of-bounds write. On a memory-constrained host, the allocation fails before `ht_undo_impl()` is entered. This is the second distinct integer overflow in `ht_undo_impl()`. CVE
date published: 2026-04-21T02:16:07.753
license: https://creativecommons.org/publicdomain/zero/1.0/
source: https://nvd.nist.gov/vuln/detail/CVE-2026-39886
publisher: AI Analytics
source organization: NIST National Vulnerability Database
main entity: Thing
  additional type: Vulnerability
  score: 5.3
  severity: MEDIUM
keywords: CWE-190

AI Analytics
type: Organization