CVE-2026-68514: CWE-122: Heap-based Buffer Overflow in AcademySoftwareFoundation openexr

The vulnerability (CVE-2026-68514) is a heap out-of-bounds write triggered in the PyOpenEXR Python bindings when processing a deep scanline EXR file that declares a literal channel named 'left' alongside layer-prefixed RGB channels 'left.R', 'left.G', and 'left.B'. The wrapper allocates a scalar deep sample array for the literal channel and then reuses it as the coalesced destination for the RGB group, which requires a three-lane RGB stride. This mismatch causes the deep reader to write past the allocated buffer during decoding, leading to heap buffer overflow, memory corruption, and application crash. The vulnerability is fixed in versions 3.3.13 and 3.4.14.

Exploitation of this vulnerability results in a heap buffer overflow causing memory corruption and a crash of the application using the PyOpenEXR bindings. There is no indication of confidentiality or integrity impact, but availability is affected due to crashes. The CVSS score is 5.5 (medium severity) with the vector indicating local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact.

Users should upgrade to openexr versions 3.3.13 or later, or 3.4.14 or later, where this heap buffer overflow vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in these versions.