PyOpenEXR CVE-2026-62986

The vulnerable code path requires all four of the following conditions to be simultaneously true: (1) the application uses the PyOpenEXR Python bindings - the C/C++ library is unaffected; (2) the target EXR file is in deep scanline format specifically, not flat scanline or tiled; (3) the file's channels use layer-prefixed naming (e.g., left.R, left.G, left.B) rather than the conventional unprefixed R, G, B; and (4) channel coalescing is active, which is the default (separate_channels=False) and requires no explicit attacker-controlled configuration change. The CVSS UI:R metric further requires that a user or automated process actively open or process the crafted file. Exploitation is bounded to same-process heap contents; no privilege escalation, cross-process access, or code execution is involved. The layer-prefix requirement limits the attack to files deliberately crafted to trigger this path, excluding most legitimate EXR files.

The vendor CVSS score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) accurately reflects the constrained impact: a low-confidentiality information disclosure gated behind user interaction. The UI:R requirement is a meaningful barrier to automated mass exploitation - a crafted EXR file must be actively opened or ingested by the target application. No EPSS score was provided in the input data; its absence prevents probabilistic exploitation rate comparison. The vulnerability does not appear in CISA KEV, and no proof-of-concept exploit code has been identified, making this a low-urgency but genuine concern for pipelines handling untrusted EXR content. SSVC assessment: exploitation status is none, automatable is no given the file-delivery requirement, and technical impact is partial, limited to same-process heap contents. The primary real-world risk sits with server-side rendering services, digital asset management platforms, and CI pipelines that ingest user-supplied EXR files - in these contexts the potential for leaking in-process sensitive data (other image data, credentials cached in heap) elevates practical concern beyond the raw CVSS score. The attack-surface specificity - deep scanline format, layer-prefixed channels, Python bindings, default coalescing mode - keeps the exploitable population narrow.

An attacker submits a crafted deep scanline EXR file with layer-prefixed RGB channels (e.g., left.R, left.G, left.B) to a web-based asset management portal or render farm API that accepts EXR uploads for preview or processing. The service calls OpenEXR.File() with default settings, receives NumPy arrays whose green and blue lanes contain raw uninitialized heap memory, then serializes or logs the arrays as part of a thumbnail generation or metadata extraction workflow - inadvertently returning or storing heap contents to the attacker. No public proof-of-concept exploit has been identified at time of analysis, though the advisory's description of the triggering conditions is specific enough for a technically capable researcher to reproduce.