The version of the OpenEXR Python package installed on the remote host is 3.4.x prior to 3.4.12. It is, therefore, affected by multiple vulnerabilities:

  - An integer overflow in ht_undo_impl() in src/lib/OpenEXRCore/internal_ht.cpp leads to a heap-buffer-overflow when     decoding a crafted HTJ2K-compressed EXR file. At line 188-189, decode->channels[i].width is multiplied by     decode->channels[i].bytes_per_element in 32-bit signed arithmetic. When width >= 536870912 with FLOAT channels,     the product exceeds INT32_MAX, causing signed integer overflow. The overflowed value is stored in     raster_line_offset and later used as a pointer offset, resulting in an out-of-bounds write past the     heap-allocated decompression buffer. (CVE-2026-44663)

  - OpenEXR's HTJ2K decoder, ht_undo_impl() in OpenEXRCore, copies decoded pixels out of a per-line OpenJPH buffer     using the EXR channel's declared width as the iteration count. The codestream embedded in the EXR chunk can     declare different (smaller) tile/line dimensions than the EXR header advertises, but ht_undo_impl() does not     validate this. A crafted EXR file produces a 4-byte heap-buffer-overflow READ immediately after a buffer     allocated by ojph::local::codestream::finalize_alloc(). The result is a deterministic crash (DoS) and potential     adjacent-heap leak. (CVE-2026-45696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Python Library OpenEXR 3.4.x < 3.4.12 Multiple Vulnerabilities

high Nessus Plugin ID 321448

Version 1.2