CVE-2026-61555
Received Received - Intake

Heap Overflow in OpenEXR Image Processing Library

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-61555
EUVD
EUVD-2026-65696

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
academysoftwarefoundation openexr to 3.4.13 (inc)
academysoftwarefoundation openexr 2.*
academysoftwarefoundation openexr 3.0.*
academysoftwarefoundation openexr 3.1.*
academysoftwarefoundation openexr 3.2.0
academysoftwarefoundation openexr 3.3.0
academysoftwarefoundation openexr 3.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the OpenEXR library, which is used for handling EXR image files. It occurs when processing a malformed EXR file with an empty multiView header attribute. The library crashes due to an out-of-bounds access in the viewFromChannelName() function when handling dotless channel names like 'R'. The issue arises because the function tries to access the first element of an empty vector without checking if it is empty first.

Detection Guidance

This vulnerability is triggered by processing malformed OpenEXR files with empty multiView headers. Detection requires checking OpenEXR versions and scanning for affected files. Use 'exrheader' or 'exrinfo' tools to inspect EXR files for malformed multiView attributes. Check OpenEXR library versions with 'exr-config --version' or 'ldconfig -p | grep OpenEXR'.

Impact Analysis

If you process EXR files using a vulnerable version of OpenEXR, a specially crafted file could cause the application to crash. This could lead to denial of service or potential data corruption if the application does not handle the crash gracefully. It primarily affects applications that rely on OpenEXR for reading or manipulating EXR image files.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a software crash issue in OpenEXR library handling malformed files. Compliance impact would depend on how the affected software is used in systems handling regulated data.

Mitigation Strategies

Upgrade OpenEXR to versions 3.2.11, 3.3.13, or 3.4.14 or later. If upgrading is not possible, avoid processing untrusted EXR files, especially those with multiView headers. Implement file validation before processing to reject malformed files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61555. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart