CVE-2026-54920

A flaw was found in OpenEXR. A remote attacker could exploit a reachable assertion failure in the HTJ2K decode path by providing a specially crafted HTJ2K-compressed EXR file. This file, containing a QCD marker with specific invalid bits, causes an unconditional process abort in applications that read untrusted input, leading to a Denial of Service (DoS).

This vulnerability only affects OpenEXR versions 3.4.0 through 3.4.12, which include HTJ2K compression support. No Red Hat products or Fedora community distributions ship a version within this range.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.