CVE-2026-62986 AcademySoftwareFoundation CVE debrief

Who should care

Defenders responsible for systems that use OpenEXR, particularly those in the motion picture industry, should assess exposure and prioritize upgrading to fixed versions. Python application developers who use PyOpenEXR to read EXR files should review their applications' handling of sample arrays.

Why it matters

CVE-2026-62986 is a vulnerability in OpenEXR's PyOpenEXR Python bindings that can lead to exposure of uninitialized heap contents and incorrect channel data. Defenders should prioritize upgrading to fixed versions and review applications that use PyOpenEXR.

• Exposure of uninitialized same-process heap contents
• Incorrect green and blue channel data in processed sample arrays
• Potential for data leakage or corruption in applications that log, serialize, or preview sample arrays
• Verification priority for applications that use PyOpenEXR to read EXR files

Technical summary

The PyOpenEXR Python bindings in OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 return stale heap data when reading a crafted deep scanline EXR file. This occurs due to incorrect lane-offset calculation in PyPart::setDeepSliceData(), leading to exposure of uninitialized same-process heap contents and incorrect green and blue channel data. A Python application that reads untrusted deep EXR files through the default OpenEXR.File API and then logs, serializes, previews, or otherwise processes the resulting NumPy sample arrays may expose uninitialized same-process heap contents, in addition to receiving incorrect green and blue channel data. This issue is fixed in versions 3.3.13 and 3.4.14.

Defensive priority

Defenders should prioritize upgrading to OpenEXR versions 3.3.13 or 3.4.14, and review applications that use PyOpenEXR to read EXR files, especially those that log, serialize, or preview sample arrays.

Recommended defensive actions

• Upgrade to OpenEXR versions 3.3.13 or 3.4.14
• Review and update applications that use PyOpenEXR to read EXR files
• Verify that applications properly handle sample arrays from PyOpenEXR
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including affected versions and fixed versions. GitHub commits and security advisories offer additional context on the patches and mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.