Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-62986 EUVD-2026-65705

OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure

Published Aug 25, 2026 · Updated Aug 25, 2026 · Assigned by GitHub_M

Description

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return stale heap data when reading a crafted deep scanline EXR that uses layer-prefixed RGB channels. With the default channel coalescing (separate_channels=False), the wrapper groups channels such as left.R, left.G, and left.B into a single RGB sample array, but the lane-offset calculation in PyPart::setDeepSliceData() only recognizes the exact unprefixed names G, B, and A. As a result, prefixed channels like left.G and left.B are decoded into lane 0 while lanes 1 and 2 are left uninitialized and returned to Python. A Python application that reads untrusted deep EXR files through the default OpenEXR.File API and then logs, serializes, previews, or otherwise processes the resulting NumPy sample arrays may expose uninitialized same-process heap contents, in addition to receiving incorrect green and blue channel data. This issue is fixed in versions 3.3.13 and 3.4.14.

Affected products

VendorProductAffectedFixed
AcademySoftwareFoundation openexr >= 3.3.0, < 3.3.13, >= 3.4.0, < 3.4.14 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 openexr 3.4.14-0.1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 openexr No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS openexr No fix yet —
Ubuntu Pro 24.04 LTS openexr No fix yet —
Ubuntu Pro 22.04 LTS openexr No fix yet —
Ubuntu Pro 20.04 LTS openexr No fix yet —
Ubuntu Pro 18.04 LTS openexr No fix yet —
Ubuntu Pro 16.04 LTS openexr No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed openexr 3.4.14-1.1 openSUSE-SU-2026:11612-1
openSUSE Tumbleweed python-OpenEXR 3.4.16-1.1 openSUSE-SU-2026:12184-1
ReleasePackageFixed inAdvisory
Alpine v3.24 openexr 3.4.15-r0 —

Advisories 2

References