Detections
Analytics
Python Library OpenEXR 3.4.0 < 3.4.14 DoS (CVE-2026-68516)
medium Nessus Plugin ID 341183
Synopsis
A Python library installed on the remote host is affected by a denial of service vulnerability.Description
The version of the OpenEXR Python package installed on the remote host is 3.4.x prior to 3.4.14. It is, therefore, affected by a denial of service vulnerability:- A crafted HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. (CVE-2026-68516)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to OpenEXR version 3.4.14 or later.See Also
Plugin Details
Severity: Medium
ID: 341183
File Name: python_openexr_CVE-2026-68516.nasl
Version: 1.1
Type: Local
Agent: windows, macosx, unix
Family: Misc.
Published: 8/28/2026
Updated: 8/28/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.63
CVSS v2
Risk Factor: High
Base Score: 7.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-68516
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Vulnerability Information
CPE: cpe:/a:academysoftwarefoundation:openexr
Patch Publication Date: 8/7/2026
Vulnerability Publication Date: 8/7/2026
Reference Information
CVE: CVE-2026-68516