AIKIDO-2026-918787

TL;DR

OpenEXRCore's planar HTJ2K decoder computes a decode loop endpoint by adding an unsigned image height to a signed chunk origin. For a file with a negative data-window Y origin and vertical subsampling, the mixed arithmetic converts the negative origin to a large unsigned value, so the loop endpoint wraps to a very large positive number. The decoder then keeps requesting component rows far past the declared image and stays CPU-bound until externally terminated. The fix computes the loop endpoint entirely in signed 64-bit arithmetic.