CVE-2026-68514 - OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep images
Brief
CVE ID : CVE-2026-68514
Published : Aug. 25, 2026, 8:17 p. m.
- 55 minutes ago
Description : OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.
- 0 through 3.
- 12 and 3.
- 0 through 3.
- 13, the PyOpenEXR Python bindings contain a heap out-of-bounds write triggered when reading a crafted deep scanline EXR file.
When a deep file declares a literal channel named left alongside layer-prefixed RGB channels left. R, left. G, and left. B, the wrapper processes the literal left channel first and allocates a scalar deep sample array for it, then reuses that same array as the coalesced destination for the prefixed RGB group.