Executive brief
OpenEXR is the reference implementation for the EXR image format, widely used in film and motion picture production. When processing EXR deep images with specific window origins, the TypedDeepImageChannel row() API can return a pointer outside its allocated memory, potentially causing crashes or disclosing sensitive data from the application's memory heap.
Technical details
The vulnerability is a heap out-of-bounds read in the TypedDeepImageChannel::row() method (and similar methods in TypedFlatImageChannel and SampleCountChannel) affecting OpenEXRUtil versions 3.3.0–3.3.12 and 3.4.0–3.4.12. The root cause is a conflicting coordinate model: the at(x, y) method uses absolute coordinates with a base offset from dataWindow.min, while row(r) is documented as 0-based logical access. When dataWindow.min is non-zero, row(0) incorrectly points outside the _sampleListPointers allocation. An attacker can exploit this by crafting a malicious EXR file with a non-zero dataWindow origin to trigger an out-of-bounds memory read. The flaw requires no special privileges; any application that processes untrusted EXR files using the vulnerable API is affected. Patches are available in versions 3.3.13 and 3.4.13.
Affected products
- Academy Software Foundation OpenEXR 3.3.0 through 3.3.12, 3.4.0 through 3.4.12
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Versions 3.3.13 and 3.4.13 contain the fix