Executive brief
OpenEXR is the standard image format for high-quality visual effects and film production. A vulnerability in how the library accesses sample data in deep images can cause it to read memory outside allocated buffers, potentially crashing applications or exposing sensitive heap data when processing malicious image files.
Technical details
The SampleCountChannel::row() API in OpenEXRUtil has a coordinate model conflict: it is documented as 0-based within the data window but internally uses a _base offset designed for absolute pixel coordinates. When a deep EXR image has a non-zero dataWindow.min origin, particularly with large negative vertical values, row(0) computes an address far outside the allocated sample-count buffer. An attacker can craft a malicious deep EXR file that triggers an out-of-bounds read when an application accesses sample counts via the row() method, causing process crash or, under controlled heap conditions, disclosure of adjacent heap memory. The vulnerability affects versions through 3.2.10, 3.3.0–3.3.12, and 3.4.0–3.4.13, and is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
Affected products
- Academy Software Foundation OpenEXR 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, 3.4.0 through 3.4.13
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Versions 3.2.11, 3.3.13, and 3.4.14 released with fix