Executive brief
OpenEXR is the standard image file format used in motion picture production for visual effects and animation. Versions 3.1–3.4 contain a memory corruption flaw triggered by specially crafted EXR image files. When an affected version reads one of these malicious files, memory can be corrupted or the application can crash, potentially disrupting production pipelines and workflows that rely on processing untrusted or third-party EXR content.
Technical details
The vulnerability is an out-of-bounds write in the B44 compressed scanline decompression routine on 32-bit (ILP32) builds. The root cause is an integer overflow in scratch buffer size computation: attacker-controlled EXR header fields (channel width) are used to calculate the logical scratch size, and this calculation truncates before memory allocation. The uncompress_b44_impl() function then writes beyond the undersized buffer using the attacker-controlled channel width. Attack vector is a maliciously crafted .exr file that must be opened (no additional user interaction required) via the OpenEXR C++ libraries, command-line tools, or Python bindings. The result is denial of service (crash) and potential memory corruption. The flaw affects versions 3.1.0–3.2.10, 3.3.0–3.3.12, and 3.4.0–3.4.13 and is patched in versions 3.2.11, 3.3.13, and 3.4.14.
Affected products
- Academy Software Foundation OpenEXR 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, 3.4.0 through 3.4.13 (ILP32 builds)
Timeline
- 2026-08-25: disclosed
- 2026-08-07: patched: Fixed in versions 3.2.11, 3.3.13, and 3.4.14