Executive brief
OpenEXR is the industry standard image format used in film and visual effects production. A flaw in how the software processes specially crafted EXR image files with a non-zero data window origin can cause the application to write to invalid memory locations. Tools and services that accept untrusted EXR files could crash, corrupt data, or potentially execute malicious code.
Technical details
The vulnerability is an out-of-bounds write (and use-after-free) in the TypedFlatImageChannel::row() method, triggered when processing EXR files with a nonzero dataWindow.min value. The root cause is an incorrect offset calculation in the row() function, which uses an absolute (x, y) base offset instead of a data-window-relative index when accessing compact backing arrays. The vulnerability requires an attacker to craft and supply a malicious EXR file; affected applications must call FlatHalfChannel::row() to write rows from a loaded image. Exploitation can lead to heap corruption, denial of service, or code execution. The issue is fixed in OpenEXR 3.2.11, 3.3.13, and 3.4.14.
Affected products
- Academy Software Foundation OpenEXR before 3.2.11, 3.3.0 through 3.3.12, 3.4.0 through 3.4.13
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in versions 3.2.11, 3.3.13, and 3.4.14