{
  "cveId": "CVE-2026-39886",
  "url": "https://patchblox.com/security/cve/CVE-2026-39886",
  "summary": "CVE-2026-39886 is fixed in openexr on 1 platform by DEBIAN-CVE-2026-39886 (version 3.4.14-0.1), released April 21, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "openexr: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for t...",
  "description": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Versions 3.4.0 through 3.4.9 have a signed integer overflow vulnerability in OpenEXR\u0027s HTJ2K (High-Throughput JPEG 2000) decompression path. The \u0060ht_undo_impl()\u0060 function in \u0060src/lib/OpenEXRCore/internal_ht.cpp\u0060 accumulates a bytes-per-line value (\u0060bpl\u0060) using a 32-bit signed integer with no overflow guard. A crafted EXR file with 16,385 FLOAT channels at the HTJ2K maximum width of 32,767 causes \u0060bpl\u0060 to overflow \u0060INT_MAX\u0060, producing undefined behavior confirmed by UBSan. On an allocator-permissive host where the required ~64 GB allocation succeeds, the wrapped negative \u0060bpl\u0060 value would subsequently be used as a per-scanline pointer advance, which would produce a heap out-of-bounds write. On a memory-constrained host, the allocation fails before \u0060ht_undo_impl()\u0060 is entered. This is the second distinct integer overflow in \u0060ht_undo_impl()\u0060. CVE-2026-34545 addressed a different overflow in the same function \u2014 the \u0060int16_t p\u0060 pixel-loop counter at line ~302 that overflows when iterating over channels whose \u0060width\u0060 exceeds 32,767. The CVE-2026-34545 fix did not touch the \u0060int bpl\u0060 accumulator at line 211, which is the subject of this advisory. The \u0060bpl\u0060 accumulator was also not addressed by any of the 8 advisories in the 2026-04-05 v3.4.9 release batch. This finding is structurally identical to CVE-2026-34588 (PIZ \u0060wcount*nx\u0060 overflow in \u0060internal_piz.c\u0060) and should be remediated with the same pattern. The CVE-2026-34588 fix did not touch \u0060internal_ht.cpp\u0060. Version 3.4.10 contains a remediation that addresses the vulnerability in \u0060internal_ht.cpp\u0060.",
  "published": "2026-04-21T02:16:07Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "epss": 0.00302,
  "epssPercentile": 0.23132,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "openexr",
      "release": "Debian 14",
      "fixedVersion": "3.4.14-0.1",
      "fix": "DEBIAN-CVE-2026-39886",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-39886",
      "released": "2026-04-21T02:16:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}