Executive brief
OpenEXR is an image format library widely used in film and visual effects production for storing high-quality image data. A crafted EXR image file can trigger an out-of-bounds memory read on 32-bit systems, causing the application to crash and deny service to users working with image files.
Technical details
The vulnerability is an out-of-bounds read in the OpenEXRCore decoding.c module affecting 32-bit (ILP32) builds. When processing a maliciously crafted uncompressed deep-tile EXR file, an integer overflow occurs during sample-count table size calculation: on ILP32 systems, a tile dimension (width × height) ≥ 2^30 causes the size_t calculation to wrap to zero or a small value, resulting in undersized buffer allocation. The unpack_sample_table() function then reads far beyond the allocated buffer. The attack requires no authentication and only involves processing a specially crafted image file. Exploitation causes a denial of service (crash). The fix changes the size computation to uint64_t with truncation checks before converting back to size_t, returning an out-of-memory error if the size exceeds SIZE_MAX.
Affected products
- Academy Software Foundation OpenEXR before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 on ILP32 builds
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in versions 3.2.11, 3.3.13, and 3.4.14