Cary Phillips reports:
[The OpenEXR 3.4.14] release addresses the following security vulnerabilities:
- CVE-2026-68514: PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow
- CVE-2026-68513: PyOpenEXR prefixed literal RGB key collision heap buffer overflow
- CVE-2026-62986: PyOpenEXR deep prefixed RGB stale lane disclosure
- CVE-2026-61703: PyOpenEXR deep mixed RGB heap buffer overflow
- CVE-2026-61555: empty multiView viewFromChannelName file crash
- CVE-2026-59985: ILP32 OpenEXRCore RLE decode heap OOB read DoS
- CVE-2026-59984: ILP32 B44 InputFile decode scratch buffer overflow
- CVE-2026-59983: ILP32 DeepTiledInputFile sample count table decode OOB read
- CVE-2026-59982: ILP32 DWAA InputFile packed AC buffer overflow
- CVE-2026-59981: OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read
- CVE-2026-59189: OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read
- CVE-2026-59187: OpenEXR exrmetrics deep pixelmode heap buffer overflow
- CVE-2026-59186: OpenEXR ILP32 TiledRgbaInputFile large tile Array2D heap OOB write
- CVE-2026-59184: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write
- CVE-2026-59183: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding