OpenEXR: 22 Memory Corruption Vulnerabilities Disclosed in Batch, Patched in 3.2.11/3.3.13/3.4.14
Academy Software Foundation's OpenEXR library patched for 22 vulnerabilities, including critical memory corruption flaws, disclosed August 24-25, 2026.
Key findings
- 22 vulnerabilities disclosed in OpenEXR between August 24-25, 2026, impacting multiple versions.
- Vulnerabilities include high-severity heap out-of-bounds writes and reads, and denial-of-service flaws.
- Affected components include PyOpenEXR Python bindings and the HTJ2K decoder.
- Patched versions are 3.2.11, 3.3.13, and 3.4.14; immediate update recommended.
- Issues are triggered by crafted EXR files, posing risks to applications processing untrusted input.
On August 24-25, 2026, a significant batch of 22 vulnerabilities was disclosed in OpenEXR, the widely used open-source reference implementation for the EXR high-dynamic-range image format critical to the motion picture industry. These vulnerabilities, primarily affecting versions prior to 3.2.11, 3.3.x, and 3.4.x, span a range of memory corruption issues including heap out-of-bounds reads and writes, pointer dereferences, and assertion failures, potentially leading to denial-of-service or exploitable conditions.
The disclosed vulnerabilities can be broadly categorized by the type of memory corruption and the affected components within OpenEXR. Several high-severity vulnerabilities, such as CVE-2026-68515, CVE-2026-59982, CVE-2026-59189, CVE-2026-59187, CVE-2026-59186, and CVE-2026-59184, involve heap out-of-bounds writes or the return of invalid heap pointers from various channel reading APIs (e.g., exrmultiview, TypedDeepImageChannel::row(), TypedFlatImageChannel::row()). These issues are often triggered by crafted EXR files with specific malformed attributes, such as incorrect data window minimums or non-zero data window dimensions.
Another group of vulnerabilities, including CVE-2026-68514, CVE-2026-68513, and CVE-2026-62986, specifically targets the PyOpenEXR Python bindings. These flaws can lead to heap out-of-bounds writes or the return of stale heap data when processing crafted deep scanline EXR files, particularly those with channel name collisions or layer-prefixed RGB channels. CVE-2026-59981 and CVE-2026-59985 also relate to out-of-bounds reads or writes, with CVE-2026-59981 stemming from the SampleCountChannel::row() API and CVE-2026-59985 occurring on ILP32 builds when processing RLE-compressed data.
Several vulnerabilities are related to the HTJ2K decoder and can lead to denial-of-service conditions. CVE-2026-53532 and CVE-2026-54920, disclosed on August 24th, involve crafted HTJ2K-compressed EXR files that trigger unconditional process aborts or assertion failures in applications calling exr_start_read(). CVE-2026-68516, also disclosed on August 24th, describes a crash during normal decode when the JPEG 2000 SIZ fields in an HTJ2K-compressed EXR place the first tile outside the image's visual bounds. CVE-2026-65979 is another HTJ2K-related issue where the decoder parses a header-length field without validating it against the buffer size.
Other notable vulnerabilities include CVE-2026-55373, which involves an infinite loop in SampleCountChannel due to improper rounding of sample list sizes, and CVE-2026-55371, a NULL pointer dereference in the exr_attr_set_bytes() function within OpenEXRCore. CVE-2026-59183 points to an integer overflow in unpack_sample_table() during the decoding of crafted deep tiled EXR files on ILP32 builds.
The affected versions span across multiple release lines, with many vulnerabilities impacting versions prior to 3.2.11, versions 3.3.0 through 3.3.12, and versions 3.4.0 through 3.4.13. Specific patches are available in versions 3.2.11, 3.3.13, and 3.4.14, addressing the majority of these issues. Users are strongly advised to update to the patched versions to mitigate the risks associated with these memory corruption and denial-of-service vulnerabilities.
This extensive batch of vulnerabilities underscores the importance of secure coding practices and thorough testing, especially for libraries handling complex file formats like OpenEXR, which are integral to critical visual effects pipelines. The sheer number and variety of memory safety issues highlight potential systemic weaknesses that require diligent patching and ongoing security review by developers and users alike.
The vulnerabilities were disclosed on August 24-25, 2026. The affected versions include releases prior to 3.2.11, versions 3.3.0 through 3.3.12, and versions 3.4.0 through 3.4.13. Patched versions are 3.2.11, 3.3.13, and 3.4.14.
The issues include heap out-of-bounds reads and writes, NULL pointer dereferences, integer overflows, and assertion failures. Many are triggered by crafted EXR files.
Several vulnerabilities specifically impact the PyOpenEXR Python bindings and the HTJ2K decoder.
The severity of the disclosed vulnerabilities ranges from Medium (CVSSv3 4.3) to High (CVSSv3 7.1), with one vulnerability rated as None (CVSSv3 0.0) due to being an assertion failure leading to a process abort.
Users of OpenEXR are strongly recommended to update to patched versions 3.2.11, 3.3.13, or 3.4.14 as soon as possible to protect against potential exploitation.