Skip to content

GHSA-3j9c-j7c9-x293

CVE Information

Summary

OpenEXR's HTJ2K decoder performs out-of-bounds pointer arithmetic when a chunk's header-length field (PLEN) is larger than the available compressed buffer, leading to an out-of-bounds read (and a process abort / DoS on UBSan or hardened builds).

Details

internal_ht_common.cpp parses the HT PLEN / header-size field, and internal_ht.cpp computes compressed_data + header_sz (and comp_buf_size - header_sz) and hands them to the OpenJPH memory-input path without first rejecting header_sz > comp_buf_size. A crafted PLEN (e.g. 0xfffffff0) advances the codestream pointer past the compressed buffer. The path is reached via attacker-controlled EXR chunk data through internal_exr_undo_ht / ht_undo_impl.

Affected: the 3.4 series, 3.4.0 through 3.4.12. The HTJ2K decoder (internal_ht.cpp) was introduced in 3.4.0, so the 3.3.x and 3.2.x branches do not contain this code and are not affected.

Fix: PR #2434 "Validate HTJ2K chunk header length before decode" (merge commit 0a227f54c816ddc4f8ed2022a0f400aaab73715b), merged to main on 2026-05-26, adds the chunk-header-length validation plus regression tests for the truncated, inflated-PLEN, and channel-count cases. It landed just after 3.4.12 (2026-05-25), so it is not in a final release yet - it is on main and in v3.4.13-rc, and will ship in 3.4.13.

Distinctness: distinct from the known ht_undo_impl decode-arithmetic overflows already assigned (CVE-2026-45696, CVE-2026-44663, CVE-2026-39886, CVE-2026-34545). Those are overflows inside the decode arithmetic; this finding is the missing bounds check on the chunk header length (PLEN) before the decode pointer arithmetic, which is why it required its own dedicated fix in #2434.

PoC

A crafted EXR file whose HTJ2K chunk carries an oversized PLEN (e.g. 0xfffffff0) drives the decoder to compute compressed_data + header_sz past the end of the compressed buffer. Opening/decoding such a file triggers the out-of-bounds read; UBSan or hardened builds abort. A self-contained reproducer can be provided on request.

Impact

Out-of-bounds read in the HTJ2K decode path (CWE-190, integer overflow leading to OOB), reachable by any consumer that decodes an attacker-supplied EXR file. On UBSan or hardened builds it aborts the process (denial of service). Severity: Moderate.