Executive brief
OpenEXR is a widely-used image format standard for motion pictures and visual effects. A vulnerability in how the library handles specially crafted EXR image files with non-zero coordinate origins can cause the application to return invalid memory pointers, leading to crashes or limited information disclosure. This could impact post-production workflows and potentially expose sensitive image data.
Technical details
The vulnerability is an out-of-bounds pointer flaw in TypedDeepImageChannel::row() and related channel classes, triggered when processing deep EXR files with a nonzero dataWindow origin. The root cause is a mismatch between the documented 0-based row access interface and the implementation, which incorrectly applied absolute-coordinate-based pointer offsets to relative row indices. An attacker can craft a malicious EXR file to trigger this condition; no authentication or user interaction beyond opening the file is required. Exploitation results in out-of-bounds memory access, causing crashes or potentially disclosing limited information. The fix, released in OpenEXR 3.2.11, 3.3.13, and 3.4.14, corrects the row() method to properly index the backing arrays relative to the data window.
Affected products
- Academy Software Foundation OpenEXR before 3.2.11, 3.3.0 through 3.3.12, 3.4.0 through 3.4.13
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in versions 3.2.11, 3.3.13, and 3.4.14