Executive brief
OpenEXR is a widely-used image format library for professional video and animation. A malformed EXR file with an empty multiView header can crash applications that process it, causing denial of service. An attacker could distribute a specially-crafted image file to cause application hangs or crashes in organizations that handle EXR files.
Technical details
The vulnerability is an out-of-bounds vector access in Imf::viewFromChannelName() when processing a crafted EXR file with an empty multiView header attribute. When parsing a dotless channel name, the code attempts to access multiView[0] without first checking whether the vector is empty, resulting in undefined behavior and application crash. The attack requires only that an application parse a malicious EXR file; no authentication or special privileges are needed. The fix, available in versions 3.2.11, 3.3.13, and 3.4.14, adds proper bounds checking before vector access.
Affected products
- Academy Software Foundation OpenEXR before 3.2.11, 3.3.0 through 3.3.12, 3.4.0 through 3.4.13
Timeline
- 2026-08-25: disclosed