CVE-2026-34545: 
NixOS vulnerability analysis and mitigation

CVE-2026-34545 is a heap-based buffer overflow vulnerability in the HTJ2K decoder of OpenEXR, the Academy Software Foundation's reference implementation of the EXR image format used in the motion picture industry. The flaw affects OpenEXR versions 3.4.0 through 3.4.6 and was disclosed on April 1, 2026, with a patch released in version 3.4.7. It carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory).

The root cause is an integer overflow (CWE-190) leading to a heap-based buffer overflow (CWE-122) in internal_ht.cpp. The loop counter p in the ht_undo_impl() function is declared as int16_t, while the channel width is stored as int32_t and never bounded to INT16_MAX. When a crafted .exr file specifies a channel width of exactly 32768, the counter overflows from 32767 to -32768 on the next increment; because the loop condition p < width remains true after integer promotion, the loop continues with a negative index, causing simultaneous out-of-bounds reads from cur_line->i32[-32768] and out-of-bounds writes to the heap buffer. The write primitive is 2 bytes per iteration (or 4 bytes via the int32_t channel path), repeating for every pixel past the overflow point. Notably, the encoding path (ht_apply_impl()) already used int32_t correctly for the same loops, making this an asymmetric oversight. A complete C++ PoC harness and a trigger .exr file are publicly available in the security advisory (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to write controlled data beyond the output heap buffer in any application that decodes EXR images, with high impact to confidentiality, integrity, and availability of the vulnerable system. The heap write overflow can lead to arbitrary code execution with the privileges of the image-processing application, enabling full system compromise, data exfiltration, or denial of service. Because EXR decoding is embedded in a wide range of media production tools, rendering pipelines, and image viewers, the attack surface spans desktop workstations and server-side batch processing systems in the motion picture and visual effects industries (GitHub Advisory).

A public proof-of-concept exploit (a standalone C++ harness with an accompanying trigger .exr file) is available in the official security advisory, confirmed by ASAN to produce a heap-buffer-overflow at internal_ht.cpp:310. Exploitation requires user interaction — a victim must open a crafted .exr file — but no privileges are required of the attacker. As of the time of reporting, there is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.055% (GitHub Advisory).

1. Craft a malicious EXR file: Create or modify an .exr file to use HTJ2K compression and set the channel width to exactly 32768 pixels (e.g., using the published PoC trigger file htj2k_width_32768_poc.exr).
2. Deliver the file to the target: Send the crafted .exr file to a victim via email, file share, download link, or any other delivery mechanism that results in the file being opened by an application using the vulnerable OpenEXR library (versions 3.4.0–3.4.6).
3. Trigger decoding: The victim opens the file in any EXR-capable application (image viewer, compositing tool, renderer). The application calls internal_exr_undo_ht(), which delegates to ht_undo_impl().
4. Integer overflow occurs: The int16_t loop counter p increments to 32767 and overflows to -32768 on the next step. The loop condition p < 32768 remains true, so the loop continues with a negative index.
5. Heap buffer overflow: The loop writes 2 or 4 bytes of controlled data per iteration beyond the end of the 65536-byte output buffer, corrupting adjacent heap memory.
6. Achieve code execution: With sufficient heap layout control (e.g., by influencing allocations before triggering the overflow), an attacker can overwrite heap metadata or function pointers to redirect execution and run arbitrary code with the privileges of the victim application (GitHub Advisory).

• File System: Presence of .exr files with HTJ2K compression and a channel width of 32768 in user download directories, temp folders, or email attachments; unexpected files written to disk by image-processing applications.
• Process: Image viewer or compositing application processes crashing with segmentation faults or heap corruption errors; child processes (e.g., shells, network utilities) spawned unexpectedly by EXR-decoding applications.
• Logs: Application crash logs or core dumps referencing internal_ht.cpp, ht_undo_impl, or internal_exr_undo_ht; ASAN/sanitizer output indicating heap-buffer-overflow at internal_ht.cpp:310.
• Network: Outbound connections from image-processing applications to unexpected external hosts following the opening of an .exr file, which may indicate post-exploitation activity (GitHub Advisory).

The primary remediation is to upgrade OpenEXR to version 3.4.7, which changes the loop counter type from int16_t to int32_t in all four affected loops within ht_undo_impl() (Patch Commit, v3.4.7 Release). If immediate patching is not feasible, restrict EXR image processing to files from trusted sources only, and consider sandboxing or containerizing image-decoding operations to limit the blast radius of potential exploitation. Disabling HTJ2K compression support at the application or pipeline level, where architecturally possible, also eliminates the vulnerable code path.

The vulnerability was reported by researcher nicoppida and credited in the official GitHub Security Advisory. The OpenSUSE security team issued a security announcement addressing the issue, and Tenable published Nessus detection plugins (IDs 304702, 304814, and 309639). No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability aggregator entries.