Heap Buffer Overflow in OpenEXR Image Processing Software by Academy Software Foundation
CVE-2026-68513
7.1HIGH
What is CVE-2026-68513?
A heap buffer overflow vulnerability exists in OpenEXR, specifically in the PyOpenEXR module, affecting versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13. This issue arises from a channel-name key collision when separate_channels is set to false. When certain channel names collide, the system erroneously uses an undersized NumPy array, leading to out-of-bounds write operations during image decoding. The vulnerability has been addressed in versions 3.3.13 and 3.4.14, and users are advised to upgrade to these versions to mitigate potential security risks.
Affected Version(s)
openexr >= 3.3.0, < 3.3.13 < 3.3.0, 3.3.13
openexr >= 3.4.0, < 3.4.14 < 3.4.0, 3.4.14