SB2026080808 - Multiple vulnerabilities in OpenEXR

Description

This security bulletin contains information about 41 vulnerabilities.

1) Out-of-bounds write (CVE-ID: CVE-2026-59982)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the DWAA scanline decode path reachable via the public C++ Imf::InputFile::readPixels() API when parsing a crafted DWAA-compressed scanline EXR file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

Only 32-bit ILP32 builds are affected; user interaction is required to open the crafted EXR file, and the issue was not demonstrated on LP64 builds.

2) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in the OpenEXRCore scanline decode path when parsing a crafted NO_COMPRESSION scanline EXR file with a short chunk packed_size. A remote attacker can supply a specially crafted EXR image to disclose sensitive information.

User interaction is required to open or otherwise process a crafted EXR file, and the issue is reachable when decoded pixels are produced through a non-direct but valid output layout.

3) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the exrmetrics utility initScanLine() FrameBuffer handling when parsing a crafted scanline EXR file with a positive non-zero dataWindow origin and a subsampled channel. A remote attacker can supply a specially crafted EXR file to cause a denial of service.

User interaction is required to open the crafted file.

4) Out-of-bounds write (CVE-ID: CVE-2026-68516)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the vendored OpenJPH HTJ2K decoder when parsing a crafted HTJ2K-compressed EXR file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open or decode a crafted EXR file.

5) Heap-based buffer overflow (CVE-ID: CVE-2026-68515)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or corrupt memory.

The vulnerability exists due to a heap-based buffer overflow in the exrmultiview utility when processing two attacker-supplied scanline EXR files whose combined data window is not aligned to a view\'s channel subsampling. A remote attacker can supply crafted EXR inputs to trigger a heap out-of-bounds write and cause a denial of service or corrupt memory.

User interaction is required to open or process the crafted EXR files.

6) Heap-based buffer overflow (CVE-ID: CVE-2026-68513)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the PyOpenEXR wrapper when opening a crafted EXR file with the default public API. A remote attacker can supply a specially crafted EXR file to cause a denial of service.

User interaction is required to open the crafted file. Only the default reader behavior without separate_channels enabled is affected.

7) Heap-based buffer overflow (CVE-ID: CVE-2026-61703)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the PyOpenEXR Python binding when opening a crafted deep EXR file through OpenEXR.File(path). A remote attacker can supply a specially crafted deep EXR file to cause a denial of service.

User interaction is required to open the crafted file.

8) Out-of-bounds read (CVE-ID: CVE-2026-61555)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in viewFromChannelName() when parsing a crafted EXR file with an empty multiView header attribute. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open or process a crafted EXR file.

9) Out-of-bounds read (CVE-ID: CVE-2026-59985)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the OpenEXRCore RLE scanline decode path when parsing a crafted RLE-compressed EXR file on ILP32 builds. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

Only 32-bit/ILP32 builds are demonstrated to be vulnerable, and user interaction is required to open the crafted file.

10) Out-of-bounds read (CVE-ID: CVE-2026-59983)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in OpenEXRCore deep sample-count decoding and DeepTiledInputFile::readPixelSampleCounts() when parsing a crafted deep-tiled EXR file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

Only 32-bit ILP32 builds are affected, and user interaction is required to open the crafted file.

11) Out-of-bounds write (CVE-ID: CVE-2026-59984)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the B44 scanline decode path reached through the public C++ Imf::InputFile::readPixels() API when parsing a crafted B44-compressed scanline EXR file on 32-bit ILP32 builds. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

Only 32-bit ILP32 builds are affected, and user interaction is required to open the crafted EXR file.

12) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of an uninitialized resource in the OpenEXRCore deep scanline decode path when processing a crafted deep scanline EXR file using NO_COMPRESSION. A remote attacker can supply a specially crafted EXR file to disclose sensitive information.

User interaction is required to open or otherwise process a crafted file through public OpenEXRCore decode APIs with valid caller-provided deep sample buffers.

13) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in OpenEXR::InputFile::rawPixelDataToBuffer() / ScanLineInputFile::rawPixelDataToBuffer() when processing a crafted EXR file with a negative signed pixelDataSize value supplied by the caller. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required, and exploitation depends on a consuming application passing an unchecked negative signed size into the public raw-pixel API.

14) Out-of-bounds read (CVE-ID: CVE-2026-59981)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the OpenEXRUtil SampleCountChannel::row() API when parsing a crafted deep EXR image with a non-zero dataWindow origin. A remote attacker can trick the victim into opening a crafted file to cause a denial of service and disclose sensitive information.

User interaction is required to open a crafted file.

15) Out-of-bounds read (CVE-ID: CVE-2026-59189)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in TypedDeepImageChannel<T>::row(row) in OpenEXRUtil when parsing a crafted deep EXR file with a non-zero dataWindow origin. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

The issue can also lead to potential information disclosure when surrounding heap layout makes the out-of-bounds pointer array entry application-observable.

16) Heap-based buffer overflow (CVE-ID: CVE-2026-59187)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the exrmetrics tool when parsing a crafted deep scanline EXR file with pixel type conversion enabled. A remote attacker can supply a specially crafted EXR file to cause a denial of service.

User interaction is required to open the crafted file, and the issue is triggered when options such as --pixelmode float or --bench are used.

17) Heap-based buffer overflow (CVE-ID: CVE-2026-59186)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow leading to a heap-based buffer overflow in the TiledRgbaInputFile RGBA API when parsing a crafted tiled EXR file. A remote attacker can supply a specially crafted tiled EXR file to cause a denial of service.

Only 32-bit/ILP32 builds are vulnerable, and user interaction is required to open or process the crafted file.

18) Out-of-bounds write (CVE-ID: CVE-2026-59184)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in OpenEXRUtil TypedFlatImageChannel<T>::row() when processing a crafted EXR file with a non-zero dataWindow.min. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open the crafted EXR file, and exploitation depends on downstream code writing rows through FlatHalfChannel::row() on a loaded image.

19) Integer overflow (CVE-ID: CVE-2026-59183)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in unpack_sample_table() in src/lib/OpenEXRCore/decoding.c when parsing a crafted deep tiled EXR file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open a crafted file. Exploitation requires processing deep tiled EXR content through the OpenEXRCore decoding path.

20) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference in OpenEXRCore channel-list setter paths when supplying a channel list with a nonzero channel count and a NULL entries pointer through the public C API. A remote attacker can provide crafted channel-list data to cause a denial of service.

The issue affects the exr_set_channels() and exr_attr_set_channels() entry points.

21) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in exr_attr_set_preview() and exr_attr_preview_create() when processing a preview attribute with nonzero dimensions and a null rgba pointer. A remote attacker can supply crafted preview attribute data to cause a denial of service.

The issue is reachable through the public OpenEXRCore C API and has not been confirmed to be directly triggerable through the standard EXR file loading path.

22) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and modify memory.

The vulnerability exists due to out-of-bounds write in the exrmetrics deep scanline sample-count handling when processing a crafted deep scanline EXR file on ILP32 builds. A remote attacker can trick the victim into opening a crafted file to cause a denial of service and modify memory.

User interaction is required to open the crafted file, and the issue is specific to ILP32 builds.

23) Use of Uninitialized Variable (CVE-ID: N/A)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use of uninitialized variable in unpack_sample_table() when parsing a crafted compressed deep-scanline EXR file with a zero-length sample-count table. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

The issue is triggered through the normal OpenEXR C and C++ decode or check paths, and user interaction is required to open the crafted file.

24) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in exr_read_scanline_chunk_info when parsing a crafted uncompressed deep-scanline EXR file. A remote attacker can provide a specially crafted EXR file to disclose sensitive information.

User interaction is required to open or process a crafted EXR file.

25) Integer Overflow to Buffer Overflow (CVE-ID: N/A)

CWE-ID: CWE-680 - Integer Overflow to Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an integer overflow to buffer overflow in deep EXR decoding of sample_count_table_size when parsing a crafted deep EXR file. A remote attacker can supply a specially crafted file to cause memory corruption.

User interaction is required to open or process a crafted deep EXR file. Only ILP32 or other 32-bit size_t builds are vulnerable.

26) Use of uninitialized resource (CVE-ID: CVE-2026-62986)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in PyOpenEXR deep RGB channel coalescing in PyPart::setDeepSliceData() when parsing an attacker-controlled deep scanline EXR file through the default OpenEXR.File(path) API. A remote attacker can supply a specially crafted EXR file to disclose sensitive information.

User interaction is required to open a crafted EXR file, and the issue affects deep images with layer-prefixed RGB channels when separate_channels is disabled.

27) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of an uninitialized resource in PyOpenEXR readPixels processing when parsing an attacker-controlled scanline EXR file with a subsampled channel through OpenEXR.File(path). A remote attacker can supply a specially crafted EXR file to disclose sensitive information.

User interaction is required to open the crafted file.

28) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and corrupt image data integrity.

The vulnerability exists due to use of an uninitialized resource in the scanline reader compact FrameBuffer handling when parsing a crafted ZIP-compressed scanline EXR file with a subsampled channel. A remote attacker can supply a specially crafted EXR file to disclose sensitive information and corrupt image data integrity.

User interaction is required to open or process the crafted EXR file.

29) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in the HTJ2K decoder channel map handling when parsing a crafted HTJ2K-compressed EXR file. A remote attacker can supply a malformed EXR file with duplicate but in-range channel map entries to disclose sensitive information.

User interaction is required to open or decode a crafted EXR file.

30) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in the UNKNOWN row-copy path in the DWA decoder when parsing a crafted DWAA or DWAB EXR image. A remote attacker can supply a specially crafted EXR image to disclose sensitive information.

User interaction is required to open or process a crafted EXR image.

31) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and modify memory.

The vulnerability exists due to out-of-bounds write in the exrmetrics deep tiled sample-count handling when parsing a crafted deep tiled EXR file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service and modify memory.

The issue is specific to ILP32 builds and requires user interaction to process an untrusted deep tiled EXR file with the shipped command-line tool.

32) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow or wraparound in the planar HTJ2K decoder in src/lib/OpenEXRCore/internal_ht.cpp when parsing a crafted EXR file with a negative data-window Y origin and vertical channel subsampling. A remote attacker can supply a specially crafted EXR file to cause a denial of service.

User interaction is required to open or process the crafted file.

33) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and overwrite heap memory.

The vulnerability exists due to an out-of-bounds write in the exrmetrics tool initTiled() tiled channel buffer handling when parsing a crafted tiled EXR file on ILP32 builds. A remote attacker can trick the victim into opening a crafted file to cause a denial of service and overwrite heap memory.

User interaction is required to process a crafted tiled EXR file, and the issue is specific to ILP32 builds.

34) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and modify memory.

The vulnerability exists due to out-of-bounds write in the exrmetrics scanline channel buffer handling when parsing a crafted public scanline EXR file on ILP32 builds. A remote attacker can trick the victim into opening a crafted file to cause a denial of service and modify memory.

User interaction is required to open the crafted EXR file. Only ILP32 builds in exrmetrics workflows are vulnerable, while LP64 builds do not truncate the allocation in the same way.

35) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the exrmultipart convert tool when parsing a crafted EXR file on ILP32 builds. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

The issue is triggered by an allocation-size truncation in channelstore sizing, and user interaction is required to process the crafted EXR file.

36) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the exrmaketiled ImageChannel Array2D allocation path when parsing a crafted EXR file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

Only 32-bit ILP32 builds are vulnerable, and user interaction is required to process the crafted EXR file with the shipped exrmaketiled CLI tool.

37) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the exrmakepreview tool when parsing a crafted EXR file on ILP32 builds. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

The issue is triggered by integer wraparound in Array2D size calculation from public dataWindow dimensions, and user interaction is required to process the crafted EXR file.

38) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in the DWA RLE stream decode path when parsing a crafted DWAA/DWAB EXR chunk through normal decode APIs. A remote attacker can provide a valid but too-short DWA RLE raw stream to disclose sensitive information.

User interaction is required to open a crafted file.

39) Heap-based buffer overflow (CVE-ID: CVE-2026-68514)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the PyOpenEXR deep reader when parsing a crafted deep scanline EXR file through the default Python API. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open the crafted file through OpenEXR.File(path).

40) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in the DWA UNKNOWN stream decode path in OpenEXRCore when parsing a crafted EXR image through normal decode APIs. A remote attacker can provide a specially crafted DWAA or DWAB EXR chunk with a short zlib inflate to disclose sensitive information.

User interaction is required to open or otherwise process a crafted EXR file.

41) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in the OpenEXRCore ZIP decode path when parsing a crafted ZIP/ZIPS-compressed EXR chunk. A remote attacker can trick the victim into opening a crafted file to disclose sensitive information.

User interaction is required to open a crafted EXR file through normal OpenEXRCore decode APIs.

Remediation

Install update from vendor's website.

References

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-6662-fq6f-93mp
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-7hgm-jxjc-6hgg
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-7h7v-98cr-8ppw
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-fw66-6xph-56jm
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-gjf7-wjjw-xq56
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-rw5h-3q4v-c3vc
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-994f-rr2m-9r7x
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-g8f2-r72m-48vx
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-p42q-g5c9-mh9w
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-92pq-9qv4-g68q
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-fwhm-jj7c-mx7v
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-fhfq-mv64-6q4j
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m799-ffc3-8pxc
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-hwmv-39v6-739m
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-6jj8-cxcr-j8hm
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-f667-c4wm-c8gq
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-pqp9-558c-453q
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-rqp5-pmwm-wj6x
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-mqmw-xv8w-5jh4
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-29q6-4p2c-77qq
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-g5m8-8w79-34q8
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-prr3-4q3r-hmf3
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-9c7r-mp54-x46f
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m5cq-cx25-qw53
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-pf59-r2mc-x746
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-c32g-9w8w-3px6
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-7828-c4f6-7v6p
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-8ggg-fhxp-95p9
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cx6p-vjc6-3php
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-xc77-xm9h-qxm4
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-hphq-wq62-4mj3
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-pgc2-hppj-q623
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-r8mj-rhfc-38g4
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-r24r-74rc-588f
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-wrw5-mm52-r3h8
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-h56j-j82x-w3fp
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-wwx8-2v36-rhr8
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-mw28-66qc-c883
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-38j8-88v6-jrm7
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-r864-gwqv-q2hp