Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-68513— OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision

Quick assessment

Affected

AcademySoftwareFoundation openexr

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Academy Software Foundation OpenEXR是美国Academy Software Foundation基金会开源的一种高动态范围图像(HDR)文件格式的开放标准。 Academy Software Foundation OpenEXR 3.3.0版本至3.3.12版本和3.4.0版本至3.4.13版本存在缓冲区错误漏洞，该漏洞源于PyOpenEXR中通道名称键冲突，当separate_channels=false时，字面量通道与带前缀的RGB通道映射后发生碰撞，在解码图像时复用

CVSS 7.1 · High EPSS 0.19% · P8 Updated Aug 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
AcademySoftwareFoundation	openexr	`>= 3.3.0, < 3.3.13`	affected
		`>= 3.4.0, < 3.4.14`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-68513

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision

Source: CVE Program / CVE List V5

Vulnerability Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 contain a heap buffer overflow in PyOpenEXR triggered by a channel-name key collision between literal and prefixed RGB channels. When separate_channels=false, PyOpenEXR maps each physical channel name through channelNameToRGBA() and coalesces the results into a shared RGB array. A crafted flat scanline EXR that contains both a literal channel such as left and prefixed channels such as left.R, left.G, and left.B causes these names to collide, so the wrapper reuses an undersized two-dimensional NumPy array for the coalesced RGB slices and writes out of bounds when OpenEXR.File(path) decodes the pixels. This issue is fixed in versions 3.3.13 and 3.4.14.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

堆缓冲区溢出

Source: CVE Program / CVE List V5

Vulnerability Title

Academy Software Foundation OpenEXR 缓冲区错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
AcademySoftwareFoundation	openexr	>= 3.3.0, < 3.3.13	-

II. Public POCs for CVE-2026-68513

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Verified env Premium

Reproduced successfully in a real sandbox · Below is the actual recording of building the environment and exploiting the vulnerability.

Success marker: VULNERABLE: SIGSEGV (exit code 139) — heap buffer overflow corrupted coalesced RGB array while decoding crafted EXR

Reproduction recording is a Pro+ exclusive

Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.

Upgrade to Pro+

claude_code · 10306 chars

GitHub 复现环境（可 clone 直接跑）

Pro+ exclusive includes:

Vulnerability reproduction recording (real sandbox build + trigger, exclusive)

In-depth vulnerability mechanism

Trigger conditions & impact

Full executable POC code

Exploit chain & mitigation

POC zip download

100+ AI POC generations per month

Upgrade to Pro+ to unlock Limited ¥499/month ¥599 Sign up first

III. Intelligence Information for CVE-2026-68513

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-68513 (2)

Vendor Advisories for CVE-2026-68513 (1)

🔗 PyOpenEXR prefixed literal RGB key collision heap buffer overflow · Advisory · AcademySoftwareFoundation/openexr · GitHub Read full article x_refsource_CONFIRM

https://www.cve.org/CVERecord?id=CVE-2026-68513

Same Patch Batch · AcademySoftwareFoundation · 2026-08-25 · 20 CVEs total

CVE-2026-59982	7.1 HIGH	OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms
CVE-2026-59981	7.1 HIGH	OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow
CVE-2026-68515	7.1 HIGH	OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union
CVE-2026-59189	7.1 HIGH	OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin
CVE-2026-59187	7.1 HIGH	OpenEXR: exrmetrics deep pixelmode heap buffer overflow
CVE-2026-59186	7.1 HIGH	OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (IL
CVE-2026-59184	7.1 HIGH	OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write
CVE-2026-55371	6.9 MEDIUM	OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length
CVE-2026-65979	6.7 MEDIUM	OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)
CVE-2026-55373	6.2 MEDIUM	OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample coun
CVE-2026-55059	6.1 MEDIUM	OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnera
CVE-2026-59984	5.5 MEDIUM	OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32
CVE-2026-59983	5.5 MEDIUM	OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32
CVE-2026-59985	5.5 MEDIUM	OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32
CVE-2026-61555	5.5 MEDIUM	OpenEXR: Empty multiView viewFromChannelName file crash
CVE-2026-68514	5.5 MEDIUM	OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collisio
CVE-2026-59183	5.5 MEDIUM	OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decod
CVE-2026-62986	4.3 MEDIUM	OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure
CVE-2026-54920		OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil im

IV. Related Vulnerabilities

Same product: openexr

Same vendor: AcademySoftwareFoundation

Same weakness: CWE-122

V. Comments for CVE-2026-68513

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-68513— OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 2

I. Basic Information for CVE-2026-68513

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-68513

III. Intelligence Information for CVE-2026-68513

Patches & Fixes for CVE-2026-68513 (2)

Vendor Advisories for CVE-2026-68513 (1)

Same Patch Batch · AcademySoftwareFoundation · 2026-08-25 · 20 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-68513

Leave a comment