CVE-2026-62986: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in AcademySoftwareFoundation openexr

OpenEXR's PyOpenEXR Python bindings improperly handle deep scanline EXR files that use layer-prefixed RGB channels. When the default channel coalescing is enabled (separate_channels=False), the wrapper groups channels like left.R, left.G, and left.B into a single RGB sample array. However, the lane-offset calculation in PyPart::setDeepSliceData() only recognizes unprefixed channel names (G, B, A). Consequently, prefixed channels such as left.G and left.B are decoded into lane 0, leaving lanes 1 and 2 uninitialized. These uninitialized lanes are returned to Python, exposing stale heap data. Applications reading untrusted deep EXR files and processing the resulting NumPy arrays may inadvertently expose sensitive same-process heap contents and receive incorrect green and blue channel data. The vulnerability is addressed in OpenEXR versions 3.3.13 and 3.4.14.

The vulnerability can lead to exposure of uninitialized heap memory contents to Python applications processing crafted deep EXR files, potentially leaking sensitive information. Additionally, the green and blue channel data returned may be incorrect, which could affect image processing results. There is no indication of integrity or availability impact. The CVSS score is 4.3 (medium severity), reflecting limited confidentiality impact with no required privileges and user interaction needed.

This issue is fixed in OpenEXR versions 3.3.13 and 3.4.14. Users and developers should upgrade to these or later versions to remediate the vulnerability. Until then, avoid processing untrusted deep EXR files with the PyOpenEXR Python bindings using default channel coalescing. No other mitigations are specified.