CVE-2026-68513: CWE-122: Heap-based Buffer Overflow in AcademySoftwareFoundation openexr

OpenEXR versions 3.3.0 to 3.3.12 and 3.4.0 to 3.4.13 contain a heap buffer overflow vulnerability in PyOpenEXR. The flaw arises when a crafted EXR file includes both literal channel names (e.g., 'left') and prefixed RGB channels (e.g., 'left.R', 'left.G', 'left.B'), causing a collision in channel-name keys. When separate_channels is set to false, PyOpenEXR maps physical channel names through channelNameToRGBA() and merges them into a shared RGB NumPy array. Due to the collision, the wrapper reuses an undersized two-dimensional array, resulting in out-of-bounds writes during pixel decoding via OpenEXR.File(path). This vulnerability is addressed in versions 3.3.13 and 3.4.14.

The vulnerability allows an attacker to cause a heap-based buffer overflow when processing a specially crafted EXR image file, potentially leading to arbitrary code execution or application crashes. The CVSS score is 7.1 (high), indicating significant impact on integrity and availability with low attack complexity and no privileges required but user interaction needed.

This vulnerability is fixed in openexr versions 3.3.13 and 3.4.14. Users should upgrade to these or later versions to remediate the issue. No vendor advisory content is provided to suggest alternative mitigations or that no action is required.