Executive brief
OpenEXR is the standard format for professional image files used throughout the motion picture and visual effects industry. A flaw in versions 3.1.0–3.4.13 allows attackers to craft malicious EXR files that crash applications when opened, disrupting post-production workflows and potentially affecting any system that processes these files automatically.
Technical details
The vulnerability is a signed integer overflow in OpenEXRCore's unpack_sample_table() function when decoding deep tiled EXR files. The vulnerable code declares width and height variables as int32_t; when processing large tile dimensions (e.g., 46342×46342), arithmetic operations like y*w and w*h overflow, producing an invalid pointer. This leads to an out-of-bounds memory read and application crash. The flaw is in the standard decoding path (exr_decoding_run), so any application that processes deep tiled EXR files is affected. No authentication or user interaction is required beyond opening a crafted file. Patches are available in versions 3.2.11, 3.3.13, and 3.4.14.
Affected products
- Academy Software Foundation OpenEXR 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, 3.4.0 through 3.4.13
Timeline
- 2026-08-25: disclosed
- patched: Fixed in versions 3.2.11, 3.3.13, and 3.4.14