Buffer Overflow in OpenEXR Affects Image Processing Software by Academy Software Foundation
CVE-2026-61555
5.5MEDIUM
What is CVE-2026-61555?
OpenEXR, the reference implementation of the EXR image format crucial in the motion picture industry, is susceptible to crashing due to improper handling by specific functions. When processing a specially crafted EXR with an empty multiView header attribute, the Imf::GetChannelsInMultiPartFile() function leads to an out-of-bounds access. This manifests when the Imf::viewFromChannelName() function attempts to index an empty vector for dotless channel names. This vulnerability is addressed in OpenEXR versions 3.2.11, 3.3.13, and 3.4.14, which include necessary fixes to prevent such crashes.
Affected Version(s)
openexr < 3.2.11 < 3.2.11
openexr >= 3.3.0, < 3.3.13 < 3.3.0, 3.3.13
openexr >= 3.4.0, < 3.4.14 < 3.4.0, 3.4.14