OpenEXR v3.3.13 Release Advisory: 15 CVEs for Heap Buffer Overflow & RCE Risks

Vulnerability Overview Version: v3.3.13 Release Date: 3 weeks ago Number of CVEs: 15 Primary Issues: Memory corruption (heap buffer overflow and out-of-bounds reads/writes) Potential Risks: Minimal impact results in process crash (Denial of Service); severe impact may lead to information disclosure or arbitrary code execution Impact Scope Affected Components: - PyOpenEXR RGB-channel-coalescing bugs - Integer-overflow-driven heap overflows on 32-bit (ILP32) builds - Heap out-of-bounds access in OpenEXRUtil and command-line tools - Crashes from malformed metadata (denial of service) Specific Vulnerabilities: - CVE-2026-68514: PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow - CVE-2026-68513: PyOpenEXR prefixed literal RGB key collision heap buffer overflow - CVE-2026-62986: PyOpenEXR deep prefixed RGB stale lane disclosure - CVE-2026-61703: PyOpenEXR deep mixed RGB heap buffer overflow - CVE-2026-61555: empty multiView viewFromChannelName file crash - CVE-2026-59985: ILP32 OpenEXRCORE RLE decode heap OOB read DoS - CVE-2026-59984: ILP32 B44 InputFile decode scratch buffer overflow - CVE-2026-59983: ILP32 DeepTiledInputFile sample count table decode OOB read - CVE-2026-59982: ILP32 DWAA InputFile packed AC buffer overflow - CVE-2026-59981: OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read - CVE-2026-59189: OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read - CVE-2026-59187: OpenEXR exrmetrics deep pixelmode heap buffer overflow - CVE-2026-59186: OpenEXR ILP32 TiledRgbInputFile large tile Array2D heap OOB write - CVE-2026-59184: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write - CVE-2026-59183: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding Remediation Updated Version: Upgrade to v3.3.13 Additional Measures: - Avoid using unverified third-party EXR files - Prioritize decoding untrusted third-party EXR files when handling pipelines, scripts, or applications - General security severity ranges from moderate (only crashes or requires unusual build configurations) to high (heap overflow triggered by small, simple crafted files) POC Code / Exploit Code Specific POC code or exploit code is not provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

OpenEXR v3.3.13 Release Advisory: 15 CVEs for Heap Buffer Overflow & RCE Risks

More from this source