CVE-2026-61555

A flaw was found in OpenEXR, a widely used image format in the motion picture industry. When processing a specially crafted EXR image file, an attacker could trigger an application crash. This occurs because the software attempts to access an empty list of image views when a specific header attribute is empty, leading to a Denial of Service (DoS) for the application.

A flaw was found in OpenEXR where processing a specially crafted EXR image file with an empty multiView header attribute can cause an application crash through an out-of-bounds read. This occurs when Imf::GetChannelsInMultiPartFile() processes the malformed file and Imf::viewFromChannelName() attempts to index the empty multiView vector for dotless channel names. Red Hat products ship OpenEXR versions that are affected by this vulnerability. Upstream has provided fixes only for the 3.2.x (3.2.11), 3.3.x (3.3.13), and 3.4.x (3.4.14) series. Products shipping older branches (1.x, 2.x, 3.0.x, 3.1.x) remain vulnerable as no fixes are available for these versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid processing untrusted EXR image files from unknown sources. Validate and sanitize EXR files before processing. Consider upgrading to OpenEXR 3.2.11 or later if the deployment context allows.