Bug 2490731

Summary:	CVE-2026-44663 usd: OpenEXR: Denial of Service via crafted HTJ2K-compressed EXR file [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Srikanth Balasubramanian <sbalasub>
Component:	usd	Assignee:	Luya Tshimbalanga <luya_tfz>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	45	CC:	adriacabellocrespo, ali.koroglu, code, luya_tfz, multimedia-sig, negativo17
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["c51f3190-fae5-4573-a31f-92a578621b40"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2490585

Description Srikanth Balasubramanian 2026-06-19 13:34:39 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Aoife Moloney 2026-08-17 14:56:22 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.

Comment 2 Ben Beasley 2026-08-18 12:31:51 UTC

I’ve tried backporting some fixes from OpenEXR upstream in the past, but the CVE’s keep piling up, and downstream backporting of dozens of patches is not sustainable. Upstream really needs to rebase their vendored OpenEXR code on a current OpenEXR release. I opened a fresh inquiry at https://github.com/PixarAnimationStudios/OpenUSD/issues/4186.

Comment 3 Ben Beasley 2026-08-26 08:25:43 UTC

The vendored OpenEXR has been updated upstream in https://github.com/PixarAnimationStudios/OpenUSD/commit/8ca068a2d06ef84a534776ac7b97973e00f6be7a, fixing dozens of CVE’s. This change isn’t a good candidate for backporting, but it should be present in the next upstream release, which will be ABI-incompatibile and therefore won’t be shipped in stable releases. Depending on when a release appears, it reach be for F46+ only, or it might also make it into F45 after the beta freeze.