CVE-2026-68513

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13

Description PyOpenEXR contains a heap buffer overflow triggered by a channel-name key collision between literal and prefixed RGB channels. When the separate channels variable is set to false, PyOpenEXR uses the channelNameToRGBA() function to map physical channel names and coalesce them into a shared RGB array. A specially crafted flat scanline EXR file containing both a literal channel (e.g., left) and prefixed channels (e.g., left.R, left.G, and left.B) causes a name collision. This leads the wrapper to reuse an undersized two-dimensional NumPy array for the coalesced RGB slices, resulting in an out-of-bounds write when OpenEXR.File(path) decodes the pixels.

Recommendations Update versions 3.3.0 through 3.3.12 to version 3.3.13. Update versions 3.4.0 through 3.4.13 to version 3.4.14.