Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-25T19:16:51.967Z",
  "pubdate": "2026-08-25T19:16:51.967Z",
  "executiveSummary": "OpenEXR is susceptible to an out-of-bounds access vulnerability during the parsing of multi-part EXR image files. The flaw resides in the logic handling of the multiView header attribute, which can be manipulated to trigger a crash within the application process.\nThe vulnerability allows a remote attacker to cause a denial-of-service (DoS) condition by providing a maliciously crafted EXR file. Successful exploitation requires the application to process the file, triggering an out-of-bounds indexing operation when the system attempts to resolve channel names in the presence of an empty multiView attribute.\nThis issue impacts OpenEXR versions 3.2.x before 3.2.11, 3.3.x through 3.3.12, and 3.4.x through 3.4.13. The risk is primarily availability-based, as the resulting crash can terminate the processing service or application. No specific authentication or elevated privileges are required for exploitation, provided the attacker can supply the malformed image to the victim's processing pipeline.",
  "technicalDetails": "The root cause of this vulnerability is an improper handling of the multiView header attribute within the Imf::GetChannelsInMultiPartFile() function. In the OpenEXR format, the multiView attribute is designed to describe views within an image; however, the parser fails to adequately validate the state of the multiView attribute when it is present but empty within the file header.\nThe attack flow initiates when the library calls Imf::GetChannelsInMultiPartFile() to iterate through the channels of a multi-part EXR file. During this operation, the library invokes Imf::viewFromChannelName() to associate channel names with specific views. If an attacker provides a crafted file where the multiView header attribute is explicitly defined as empty, the internal state representing the views becomes an empty vector.\nWhen Imf::viewFromChannelName() processes a channel name that lacks a dot (indicating it does not belong to a standard view-based naming convention), the function attempts to index or access the view vector based on the assumption that valid indices exist. Because the vector is empty due to the malicious header configuration, the index operation accesses memory outside the bounds of the allocated buffer. This leads to an unhandled exception or illegal memory access, resulting in a segmentation fault and an immediate crash of the host application.\nThe vulnerability is localized to the OpenEXR image parsing logic. It does not appear to require complex exploitation techniques such as ROP chains or memory corruption for arbitrary code execution; rather, it is a direct crash vector impacting system availability. As the processing of EXR files is a common task in visual effects and animation pipelines, this flaw could be leveraged to disrupt automated render farms or image-viewing workstations that ingest untrusted third-party assets. Because the crash occurs during the parsing stage, the vulnerability can be triggered without prior authentication or privilege escalation, making it a reliable DoS vector for any system relying on the vulnerable versions of the OpenEXR library."
}