CVE-2026-68514

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13

Description The PyOpenEXR Python bindings contain a heap out-of-bounds write that occurs when reading a specially crafted deep scanline EXR file. The issue arises when a deep file declares a literal channel named left alongside layer-prefixed RGB channels left.R, left.G, and left.B. The wrapper allocates a scalar deep sample array for the left channel and subsequently reuses it as the destination for the RGB group. Because the deep reader registers sample slices with an RGB stride into storage allocated for a scalar shape, decoding the samples writes past the allocated memory. Triggering this via the public Python API OpenEXR.File(path) results in a heap buffer overflow, leading to memory corruption and a crash.

Recommendations Update versions 3.3.0 through 3.3.12 to version 3.3.13. Update versions 3.4.0 through 3.4.13 to version 3.4.14.