Nixpkgs security tracker

Untriaged

Permalink CVE-2026-68516

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 5 days, 6 hours ago Activity log

Created suggestion 5 days, 6 hours ago

OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.

References

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-fw66-6xph-56jm x_refsource_CONFIRM
https://github.com/AcademySoftwareFoundation/openexr/commit/45521f92104373b5c850f27f2d4659ab6759e848 x_refsource_MISC
https://github.com/AcademySoftwareFoundation/openexr/commit/85009d840cc085aa96ad03ae76fa6463defeb0e5 x_refsource_MISC

Affected products

openexr

==>= 3.4.0, < 3.4.14

Matching in nixpkgs

pkgs.openexr

High dynamic-range (HDR) image file format

nixos-unstable 3.4.10
- nixpkgs-unstable 3.4.11
- nixos-unstable-small 3.4.13
nixos-26.05 3.4.11
- nixos-26.05-small 3.4.11
- nixpkgs-26.05-darwin 3.4.11

pkgs.openexr_2

High dynamic-range (HDR) image file format

nixos-unstable 2.5.10
- nixpkgs-unstable 2.5.10
- nixos-unstable-small 2.5.10
nixos-26.05 2.5.10
- nixos-26.05-small 2.5.10
- nixpkgs-26.05-darwin 2.5.10

pkgs.openexrid-unstable

OpenEXR files able to isolate any object of a CG image with a perfect antialiazing

nixos-unstable 2017-09-17
- nixpkgs-unstable 2017-09-17
- nixos-unstable-small 2017-09-17
nixos-26.05 2017-09-17
- nixos-26.05-small 2017-09-17
- nixpkgs-26.05-darwin 2017-09-17

pkgs.haskellPackages.openexr-write

Library for writing images in OpenEXR HDR file format

nixos-unstable 0.1.0.2
- nixpkgs-unstable 0.1.0.2
- nixos-unstable-small 0.1.0.2
nixos-26.05 0.1.0.2
- nixos-26.05-small 0.1.0.2
- nixpkgs-26.05-darwin 0.1.0.2

Package maintainers

@paperdigits Mica Semrick <mica@silentumbrella.com>
@guibou Guillaume Bouchard <guillaum.bouchard@gmail.com>

Suggestion detail