Executive brief
OpenEXR is the standard library for reading and writing high-quality image files used extensively in film and animation production. A malicious EXR image file can trigger a heap buffer overflow when opened, potentially allowing an attacker to crash the application or execute arbitrary code. Organizations using OpenEXR to process untrusted image files are at risk of service disruption or compromise.
Technical details
A heap buffer overflow exists in PyOpenEXR's channel coalescing logic when separate_channels=false. The vulnerability occurs when an EXR file contains both literal channel names (e.g., "left") and their prefixed variants (e.g., "left.R", "left.G", "left.B"), causing a channel-name collision. The channelNameToRGBA() function maps these names into shared RGB arrays, but the wrapper allocates an undersized NumPy array to hold the coalesced results. When OpenEXR.File(path) decodes such a crafted flat scanline EXR, it writes out of bounds on the heap. This affects versions 3.3.0–3.3.12 and 3.4.0–3.4.13. The fix (versions 3.3.13 and 3.4.14) validates that no conflicting channel names exist before attempting coalescing.
Affected products
- Academy Software Foundation OpenEXR 3.3.0 through 3.3.12, 3.4.0 through 3.4.13
Timeline
- 2026-08-25: disclosed
- 2026-08-04: patched: Patches committed for versions 3.3.13 and 3.4.14