Tinyexr through version 3.2.0 contains a heap out‑of‑bounds read in the function ParseEXRMultipartHeaderFromMemory caused by a stale remaining‑size value. When a malicious multipart EXR file is parsed, the header processing can bypass bounds checks and read data beyond the intended buffer. This flaw allows an attacker to retrieve contents of adjacent heap memory, potentially revealing sensitive information, or to cause the application to crash, resulting in a denial‑of‑service.

The vulnerability affects all releases of the Tinyexr library from its inception up to and including 3.2.0. Any software that links against these builds and parses EXR files—especially multipart images—is potentially impacted. This includes graphics editors, rendering engines, scientific visualisation tools, and any other applications that decode EXR formats.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is very low (<1%), and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to provide a crafted EXR file to the vulnerable application, which could be achieved locally or remotely depending on how images are sourced. Since the flaw only permits reading memory and does not enable code execution, the immediate risk is limited to data leakage or instability. However, repeated or large‑scale exploitation could elevate the impact by facilitating persistent information exposure or disrupting application availability.