Executive brief
OpenEXR is a widely-used image format standard in motion picture production. A flaw in the PyOpenEXR Python library causes a heap buffer overflow when processing specially crafted EXR files with conflicting channel names. Attackers can crash applications or potentially achieve code execution by distributing malicious image files.
Technical details
The PyOpenEXR Python bindings contain a heap out-of-bounds write vulnerability in the deep scanline decoder. When processing a deep EXR file containing both a literal channel named "left" and layer-prefixed RGB channels ("left.R", "left.G", "left.B"), the code incorrectly reuses a scalar-shaped sample array (allocated for the literal channel) as the destination for RGB-strided data. This causes writes past the buffer boundary during deep sample decoding. The vulnerability can be triggered via the default public API (OpenEXR.File) without authentication. Fixed in versions 3.3.13 and 3.4.14 by validating and rejecting conflicting channel configurations.
Affected products
- Academy Software Foundation OpenEXR 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13
Timeline
- 2026-08-25: disclosed
- 2026-08-02: patched: Fix committed