OpenEXR CVE-2026-68515

Exploitation requires that a user or automated process invoke the exrmultiview utility on two attacker-supplied EXR files where at least one file contains channels with xSampling or ySampling values other than 1, and the resulting union dataWindow is misaligned to that subsampling. The individual files are valid EXR files on their own; the vulnerability is triggered by their combination. The CVSS vector (AV:L/UI:R) confirms exploitation is constrained to local execution where a user or pipeline actively runs the exrmultiview command. Standard EXR files with xSampling=1 and ySampling=1 on all channels are not affected. Exploitation is further limited to environments where exrmultiview is in active use, predominantly VFX and film production pipelines that routinely ingest externally sourced EXR content.

The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) accurately reflects the attack surface: local execution with required user interaction, no confidentiality impact, but high integrity and availability impact from heap corruption. The local vector and UI:R requirement meaningfully constrain real-world risk - an attacker cannot exploit this remotely without first delivering crafted files and inducing their processing by a user or automated pipeline. In VFX and render-farm environments, however, processing externally sourced EXR files via command-line tools like exrmultiview is routine, making that constraint less protective in practice. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, consistent with no confirmed active exploitation. No POC exploit code is referenced. The description explicitly notes this is not a caller-precondition issue - normal invocation syntax (exrmultiview left A.exr right B.exr out.exr) triggers the bug, which raises the exploitability ceiling compared to API-only vulnerabilities requiring library integration.

An attacker crafts two individually valid scanline EXR files in which channel subsampling parameters are set to produce a misaligned union dataWindow when the files are combined, then submits them to a VFX render pipeline that invokes exrmultiview to merge left/right stereo views. When the pipeline executes exrmultiview left A.exr right B.exr out.exr, the truncated heap allocation is written past, corrupting adjacent heap metadata and potentially crashing the process or enabling further heap-based exploitation. No public POC exploit code has been identified at time of analysis.