CVE-2026-53532

A flaw was found in OpenEXR. A remote attacker can provide a specially crafted HTJ2K-compressed EXR file, which causes an unconditional process abort in applications that process untrusted input. This denial of service occurs because OpenEXR passes a malformed QCD marker to the vendored OpenJPH library, triggering an assertion that cannot be gracefully handled. This vulnerability can lead to the unavailability of services using OpenEXR to process image files.

This vulnerability only affects OpenEXR versions 3.4.0 through 3.4.12, which include HTJ2K compression support. No Red Hat products or Fedora community distributions ship a version within this range.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.