Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 contain a heap buffer overflow in PyOpenEXR triggered by a channel-name key collision between literal and prefixed RGB channels. When separate_channels=false, PyOpenEXR maps each physical channel name through channelNameToRGBA() and coalesces the results into a shared RGB array. A crafted flat scanline EXR that contains both a literal channel such as left and prefixed channels such as left.R, left.G, and left.B causes these names to collide, so the wrapper reuses an undersized two-dimensional NumPy array for the coalesced RGB slices and writes out of bounds when OpenEXR.File(path) decodes the pixels. This issue is fixed in versions 3.3.13 and 3.4.14.
Published: 2026-08-25
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution via crafted EXR files that exploit a heap overflow in PyOpenEXR
Action: Patch immediately
AI Analysis

Impact

A heap buffer overflow exists in PyOpenEXR when a channel‑name collision occurs between literal (e.g., left) and prefixed RGB channels (e.g., left.R, left.G, left.B). During decoding, the wrapper reuses an undersized NumPy array for the coalesced RGB slices and writes out of bounds, potentially corrupting memory and allowing an attacker to execute arbitrary code. The CVSS score of 7.1 indicates a high‑severity vulnerability.

Affected Systems

The AcademySoftwareFoundation OpenEXR library is affected. Vulnerable releases include 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13. Versions 3.3.13 and 3.4.14, which contain the fix, are not affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1 and is not listed in CISA’s KEV catalog. EPSS is not available, so the exploitation probability is unknown. Attackers can trigger the overflow by supplying a malicious flat‑scanline EXR file. The flaw is local to the process using PyOpenEXR, but if the library is invoked by a server or service that receives untrusted EXR files, the vulnerability could be exploited remotely.

Generated by OpenCVE AI on August 26, 2026 at 03:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch by upgrading to OpenEXR 3.3.13 or 3.4.14.
  • If upgrading is not immediately feasible, restrict untrusted EXR processing to a sandboxed environment or disable PyOpenEXR usage for external input.
  • Implement input validation to detect and reject malformed EXR files with channel‑name collisions before decoding, such as by checking that literal and prefixed channel names are not combined.

Generated by OpenCVE AI on August 26, 2026 at 03:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 contain a heap buffer overflow in PyOpenEXR triggered by a channel-name key collision between literal and prefixed RGB channels. When separate_channels=false, PyOpenEXR maps each physical channel name through channelNameToRGBA() and coalesces the results into a shared RGB array. A crafted flat scanline EXR that contains both a literal channel such as left and prefixed channels such as left.R, left.G, and left.B causes these names to collide, so the wrapper reuses an undersized two-dimensional NumPy array for the coalesced RGB slices and writes out of bounds when OpenEXR.File(path) decodes the pixels. This issue is fixed in versions 3.3.13 and 3.4.14.
Title OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision
Weaknesses CWE-122
CWE-787
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-28T22:34:26.075Z

Reserved: 2026-07-30T16:19:08.082Z

Link: CVE-2026-68513

cve-icon Vulnrichment

Updated: 2026-08-28T22:34:17.441Z

cve-icon NVD

Status : Deferred

Published: 2026-08-25T20:17:02.463

Modified: 2026-09-09T21:07:31.353

Link: CVE-2026-68513

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T03:15:03Z

Weaknesses