CVE-2026-68515 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union
Attacker can trigger heap out-of-bounds write in exrmultiview by providing crafted EXR files, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-68515?
CVE-2026-68515 is a high-severity memory corruption vulnerability in AcademySoftwareFoundation openexr, published on 25 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it combines two attacker-supplied, individually valid scanline EXR files whose union dataWindow is not aligned to one view's channel subsampling. The utility allocates sampled channel storage using a truncated union_width / xSampling, then reads the sampled input through a Slice based on the misaligned union window, producing a heap out-of-bounds write. The trigger is normal public-tool processing, such as exrmultiview left A.exr right B.exr out.exr with crafted but valid inputs, so this is not solely an API or caller-precondition issue. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Which versions are affected by CVE-2026-68515?
Linux distribution packages (23)
openexr AlmaLinux:10 | All versions | 3.1.10-8.el10_2.4 |
openexr-devel AlmaLinux:10 | All versions | 3.1.10-8.el10_2.4 |
openexr-libs AlmaLinux:10 | All versions | 3.1.10-8.el10_2.4 |
openexr AlmaLinux:9 | All versions | 3.1.1-3.el9_8.4 |
openexr-devel AlmaLinux:9 | All versions | 3.1.1-3.el9_8.4 |
openexr-libs AlmaLinux:9 | All versions | 3.1.1-3.el9_8.4 |
openexr Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.4 |
openexr-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.4 |
openexr-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.4 |
openexr-devel Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.4 |
openexr-libs Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.4 |
openexr-libs-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.10-8.el10_2.4 |
openexr Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_8.4 |
openexr-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_8.4 |
openexr-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_8.4 |
openexr-libs Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_8.4 |
openexr-libs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.1.1-3.el9_8.4 |
openexr-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:3.1.1-3.el9_8.4 |
openexr-debugsource Red Hat:enterprise_linux:9::crb | All versions | 0:3.1.1-3.el9_8.4 |
openexr-devel Red Hat:enterprise_linux:9::crb | All versions | 0:3.1.1-3.el9_8.4 |
openexr-libs-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:3.1.1-3.el9_8.4 |
openexr Rocky Linux:10 | All versions | 0:3.1.10-8.el10_2.4 |
openexr Rocky Linux:9 | All versions | 0:3.1.1-3.el9_8.4 |
How do I fix CVE-2026-68515?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-68515 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-68515 exists.
Sources
Also known as ALSA-2026:69608, ALSA-2026:69609, AZL-97646, BELL-CVE-2026-68515, CLSA-2026-1790780350, CLSA-2026-1790781324 and 12 more.