OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 an…

CVE-2026-68513 describes a heap buffer overflow vulnerability in PyOpenEXR, the Python wrapper for the OpenEXR image format library used in the motion picture industry. The flaw affects versions 3.3.0–3.3.12 and 3.4.0–3.4.13 and is triggered by a channel-name key collision between literal and prefixed RGB channels. When separate_channels=false, the channelNameToRGBA() function fails to properly handle crafted EXR files containing both literal channels (e.g., 'left') and prefixed channels (e.g., 'left.R', 'left.G', 'left.B'). This collision causes the wrapper to reuse an undersized NumPy array, resulting in an out-of-bounds write during pixel decoding. An attacker could exploit this by supplying a specially crafted flat scanline EXR file. The vulnerability has been patched in versions 3.3.13 and 3.4.14.