ANT-2026-QQ2P9M9V: Heap-buffer-overflow in internal_ht.cpp:305

While decoding a crafted OpenEXR file that uses HTJ2K (High-Throughput JPEG 2000) compression, ht_undo_impl() in OpenEXRCore reads 4 bytes past the end of a buffer allocated by the bundled OpenJPH codestream allocator. The overflow is reached through the normal file-decoding path (exr_uncompress_chunk → internal_exr_undo_ht → ht_undo_impl), so any application that opens untrusted EXR files can hit it. The attacker controls the EXR/HTJ2K codestream contents that determine the buffer size and the read offset. The result is an out-of-bounds read that could cause a crash (DoS) or leak adjacent heap memory.

Target

Project: openexr
Location: internal_ht.cpp:305

Technical Details

ASAN: "READ of size 4 at 0x7aed229e5428 ... heap-buffer-overflow ... internal_ht.cpp:305:45 in ht_undo_impl". The read lands immediately after a 21033-byte region allocated via ojph::local::codestream::finalize_alloc(), indicating ht_undo_impl pulls a 32-bit value from the OpenJPH-decoded line/component buffer without validating that the decoded codestream dimensions match the EXR channel/scanline dimensions it is iterating over.

Crash trace (truncated — full trace in attached crash.log):

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2979886539
INFO: Loaded 1 modules   (45624 inline 8-bit counters): 45624 [0x58074f7c1bf0, 0x58074f7cce28), 
INFO: Loaded 1 PC tables (45624 PCs): 45624 [0x58074f7cce28,0x58074f87f1a8), 
/out/openexr_exrcorecheck_fuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1


=== ASAN Report ===
=================================================================
==26==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7aed229e5428 at pc 0x58074f458a4a bp 0x7ffe094f96f0 sp 0x7ffe094f96e8
READ of size 4 at 0x7aed229e5428 thread T0
    #0 0x58074f458a49 in ht_undo_impl /src/openexr/src/lib/OpenEXRCore/internal_ht.cpp:305:45
    #1 0x58074f458a49 in internal_exr_undo_ht /src/openexr/src/lib/OpenEXRCore/internal_ht.cpp:338:16
    #2 0x58074f3f5d07 in exr_uncompress_chunk /src/openexr/src/lib/OpenEXRCore/compression.c:542:14
    #3 0x58074f4211b2 in exr_decoding_run /src/openexr/src/lib/OpenEXRCore/decoding.c:580:14
    #4 0x58074f1a7be6 in readCoreScanlinePart /src/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1447:18
    #5 0x58074f1a7be6 in Imf_4_0::(anonymous namespace)::checkCoreFile(_priv_exr_context_t*, bool, bool) /src/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1675:17
    #6 0x58074f1a53da in runCoreChecks /src/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1817:15
    #7 0x58074f1a53da in Imf_4_0::checkOpenEXRFile(char const*, unsigned long, bool, bool, bool) /src/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1849:16
    [... 25 more frames — full trace in crash.log]

Reproduction

1. Craft an EXR file with a scanline part whose chunk uses HTJ2K compression and whose embedded JPEG 2000 codestream declares dimensions/components smaller than the EXR channel layout expects
2. Deliver the file to the victim (download, email attachment, asset pipeline, thumbnailer)
3. Victim application calls exr_decoding_run / exr_uncompress_chunk on the part
4. ht_undo_impl reads a 32-bit sample past the end of the OpenJPH-allocated line buffer

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-QQ2P9M9V.

Reference: ANT-2026-QQ2P9M9V
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure