ECHO-d0fa-76ab-4b21
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-d0fa-76ab-4b21.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-d0fa-76ab-4b21
- Upstream
- Withdrawn
- 2026-06-24T18:00:04Z
- Published
- 2026-06-21T16:44:41Z
- Modified
- 2026-09-15T03:33:45Z
- Summary
- Heap-buffer-overflow READ in ht_undo_impl() via codestream/channel width mismatch in the HTJ2K decoder. HTJ2K support (OpenEXRCore internal_ht.cpp / ht_undo_impl) was added in 3.4.0; affected range is 3.4.0-3.4.11. The codec does not exist in 3.1.x, so 3.1.13 is not affected (Debian reports only a fixed_version, not the affected range).
- Details
- References