CVE-2026-68516

A flaw was found in OpenEXR. A remote attacker could provide a specially crafted HTJ2K-compressed EXR image file. When OpenEXR processes this file with JPEG 2000 SIZ fields that place the first tile outside the visible image, it can lead to invalid tile and codeblock geometry. This results in a stack out-of-bounds write, causing a denial of service.

This vulnerability only affects OpenEXR versions 3.4.0 through 3.4.13, which include HTJ2K compression support. No Red Hat products or Fedora community distributions ship a version within this range.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.