Vulnerability · Published Aug 25, 2026 · Assigned by GitHub_M
CVE-2026-62986OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure
Medium 4.3
In plain English
A medium-severity information exposure in openexr from AcademySoftwareFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return stale heap data when reading a crafted deep scanline EXR that uses layer-prefixed RGB channels. With the default channel coalescing (separate_channels=False), the wrapper groups channels such as left.R, left.G, and left.B into a single RGB sample array, but the lane-offset calculation in PyPart::setDeepSliceData() only recognizes the exact unprefixed names G, B, and A. As a result, prefixed channels like left.G and left.B are decoded into lane 0 while lanes 1 and 2 are left uninitialized and returned to Python. A Python application that reads untrusted deep EXR files through the default OpenEXR.File API and then logs, serializes, previews, or otherwise processes the resulting NumPy sample arrays may expose uninitialized same-process heap contents, in addition to receiving incorrect green and blue channel data. This issue is fixed in versions 3.3.13 and 3.4.14.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | openexr | 3.4.15-r0 | ALPINE-CVE-2026-62986 |
| Debian:14 | openexr | 3.4.14-0.1 | DEBIAN-CVE-2026-62986 |
| Ubuntu:26.10 | openexr | no fix listed | UBUNTU-CVE-2026-62986 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.3.0, < 3.3.13>= 3.4.0, < 3.4.14 |
Weakness: CWE-200, CWE-457, CWE-908 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-pf59-r2mc-x746 x_refsource_CONFIRM
- https://github.com/AcademySoftwareFoundation/openexr/commit/36ff0968de08d7ae80792f9f53402f93433207bb x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/commit/5105809507ba572d8cad12ec9f5a5c9d378354b9 x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/commit/5a534e2228c853034e5cb9d2599ebf82f48f51b0 x_refsource_MISC