Heap Data Exposure Vulnerability in OpenEXR's Python Bindings
CVE-2026-62986
4.3MEDIUM
What is CVE-2026-62986?
The OpenEXR Python bindings in specific versions suffer from a vulnerability where uninitialized heap data can be exposed when processing deep scanline EXR images with prefixed RGB channels. The default channel coalescing fails to correctly handle layer-prefixed channel names, resulting in incorrect decoding and potentially allowing untrusted Python applications to log or manipulate unchanged heap content. This vulnerability underscores the necessity for users to update to secure versions to mitigate the risk of unintended data exposure.
Affected Version(s)
openexr >= 3.3.0, < 3.3.13 < 3.3.0, 3.3.13
openexr >= 3.4.0, < 3.4.14 < 3.4.0, 3.4.14