---
id: CVE-2026-62986
title: >-
  OpenEXR is the reference implementation and specification for the EXR image
  file format, widely used in the motion picture industry
summary: >-
  OpenEXR is the reference implementation and specification for the EXR image
  file format, widely used in the motion picture industry. In versions 3.3.0
  through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return
  stale he…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
  - CWE-457
  - CWE-908
published: '2026-08-25'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:07:31.353'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62986'
references:
  - url: >-
      https://github.com/AcademySoftwareFoundation/openexr/commit/36ff0968de08d7ae80792f9f53402f93433207bb
    label: security-advisories@github.com
  - url: >-
      https://github.com/AcademySoftwareFoundation/openexr/commit/5105809507ba572d8cad12ec9f5a5c9d378354b9
    label: security-advisories@github.com
  - url: >-
      https://github.com/AcademySoftwareFoundation/openexr/commit/5a534e2228c853034e5cb9d2599ebf82f48f51b0
    label: security-advisories@github.com
  - url: >-
      https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-pf59-r2mc-x746
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.0038
epssPercentile: 0.2928
ingestedAt: '2026-09-09T21:22:45.553Z'
---

## Overview

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings return stale heap data when reading a crafted deep scanline EXR that uses layer-prefixed RGB channels. With the default channel coalescing (separate_channels=False), the wrapper groups channels such as left.R, left.G, and left.B into a single RGB sample array, but the lane-offset calculation in PyPart::setDeepSliceData() only recognizes the exact unprefixed names G, B, and A. As a result, prefixed channels like left.G and left.B are decoded into lane 0 while lanes 1 and 2 are left uninitialized and returned to Python. A Python application that reads untrusted deep EXR files through the default OpenEXR.File API and then logs, serializes, previews, or otherwise processes the resulting NumPy sample arrays may expose uninitialized same-process heap contents, in addition to receiving incorrect green and blue channel data. This issue is fixed in versions 3.3.13 and 3.4.14.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.