CVE-2026-68514
Received Received - Intake

Heap Out-of-Bounds Write in PyOpenEXR via Deep Scanline EXR

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings contain a heap out-of-bounds write triggered when reading a crafted deep scanline EXR file. When a deep file declares a literal channel named left alongside layer-prefixed RGB channels left.R, left.G, and left.B, the wrapper processes the literal left channel first and allocates a scalar deep sample array for it, then reuses that same array as the coalesced destination for the prefixed RGB group. The deep reader registers sample slices with an RGB stride (three lanes) into storage that was allocated with scalar shape, so decoding the deep samples writes past the allocation. Opening such a file through the default public Python API, OpenEXR.File(path), causes a heap buffer overflow during normal deep sample decode, leading to memory corruption and a crash. This issue is fixed in versions 3.3.13 and 3.4.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-26
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-68514
EUVD
EUVD-2026-65745

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
academysoftwarefoundation pyopenexr From 3.3.0 (inc) to 3.3.13 (exc)
academysoftwarefoundation pyopenexr From 3.4.0 (inc) to 3.4.14 (exc)
openexr pyopenexr From 3.3.0 (inc) to 3.4.13 (inc)
openexr pyopenexr 3.3.13
openexr pyopenexr 3.4.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEXR's PyOpenEXR Python bindings have a heap out-of-bounds write vulnerability in versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13. This occurs when reading a crafted deep scanline EXR file with a literal channel named 'left' alongside layer-prefixed RGB channels. The wrapper incorrectly allocates and reuses memory, causing a buffer overflow during deep sample decode.

Detection Guidance

To detect this vulnerability, check the installed version of PyOpenEXR. Vulnerable versions are 3.3.0 to 3.3.12 and 3.4.0 to 3.4.13. Use commands like 'pip show PyOpenEXR' or 'python -c "import OpenEXR; print(OpenEXR.__version__)"' to verify the version.

Impact Analysis

This vulnerability can cause memory corruption and crashes when opening malicious EXR files through the default Python API. It may lead to denial-of-service conditions or potential arbitrary code execution if exploited.

Compliance Impact

This vulnerability primarily causes crashes or memory corruption when processing crafted deep scanline EXR files through PyOpenEXR. It does not directly impact data confidentiality or integrity but may lead to denial-of-service conditions in applications handling untrusted files. Compliance implications depend on whether such disruptions could interfere with data processing or availability requirements in GDPR or HIPAA contexts.

Mitigation Strategies

Upgrade PyOpenEXR to version 3.3.13 or 3.4.14 or later to fix the heap out-of-bounds write vulnerability. Avoid opening untrusted EXR files, especially those with crafted deep scanline data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68514. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart