PyOpenEXR CVE-2026-68514

Exploitation requires the target application to use the PyOpenEXR Python bindings specifically (not the raw C++ OpenEXR library) and invoke the default OpenEXR.File(path) API without the separate_channels=True parameter. The vulnerable code path is triggered only when the input EXR file is a deep scanline or deep tiled file containing a channel naming collision: a literal channel whose name exactly matches the group key that coalescing would generate from layer-prefixed RGB channels (e.g., literal 'left' plus 'left.R', 'left.G', 'left.B'). The CVSS vector confirms UI:R - a user or automated process must actively open the crafted file - and AV:L, meaning the file must be present in a location accessible to the processing application. No network-facing remote code execution vector is indicated. Using separate_channels=True fully prevents the vulnerability. No authentication is required to trigger the flaw once the file is opened, consistent with PR:N.

The CVSS 3.1 score of 5.5 Medium with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H accurately reflects the threat model: exploitation requires a victim to open a crafted file (UI:R) in a local or pipeline context (AV:L), with no confirmed confidentiality or integrity impact - only availability loss via crash and memory corruption. No EPSS data was included in the source intelligence, and this CVE has no CISA KEV listing and no identified public exploit code, making real-world exploitation currently unconfirmed. The realistic risk is highest for VFX studios and automated media ingestion pipelines where processing third-party or untrusted EXR files is routine. The CVSS Medium rating aligns well with this threat profile: no remote unauthenticated vector, no privilege escalation pathway, and no data exfiltration impact are indicated by any available signal. The triggering condition - a specific channel naming collision - is trivially constructible by an attacker but requires file delivery to a vulnerable consumer.

An attacker crafts a deep scanline EXR file containing a literal channel named 'left' alongside 'left.R', 'left.G', and 'left.B' layer-prefixed channels, then delivers it to a VFX production pipeline, rendering farm job, or media management tool using the PyOpenEXR Python API. When the application invokes the default OpenEXR.File(path) call on the crafted file, the channel coalescing logic triggers the heap buffer overflow, crashing the process. In batch-ingestion environments that process untrusted or user-submitted EXR assets without isolation, repeated delivery of such files could serve as a sustained denial-of-service attack against the processing pipeline.