In OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 the PyOpenEXR bindings incorrectly calculate lane offsets for deep scanlines that use layer‑prefixed RGB channels. When a crafted EXR file is processed, the wrapper treats channels such as left.R, left.G, and left.B as a single RGB array but the lane‑offset logic only recognizes unprefixed G, B, and A. The result is that left.G and left.B are decoded into lane 0, while lanes 1 and 2 are left uninitialized. The uninitialized memory is returned to Python as part of a NumPy array. A Python program that reads untrusted deep EXR files through the default OpenEXR.File API and then logs, serializes, previews, or otherwise processes the NumPy sample arrays can therefore expose same‑process heap contents or receive incorrect green and blue channel data.

The Academy Software Foundation’s OpenEXR library (openexr) is affected. Vulnerable releases are 3.3.0 to 3.3.12 and 3.4.0 to 3.4.13. All builds that use the default channel coalescing (separate_channels=False) for deep scanlines can be impacted.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score is not available, implying no known widespread exploitation activity. The vulnerability is not listed in the CISA KEV catalog. The attack likely requires a local, privileged or unprivileged user to provide a crafted deep EXR file to the target Python application. A malicious file can leak internal heap data or corrupt image data for any process that imports PyOpenEXR and processes such files without additional validation. No remote or network exploitation path is explicitly documented.