The vulnerability is a heap buffer overflow that occurs during parsing of malformed EXR files when the OpenEXR library uses a memory‑mapped IStream. A signed integer subtraction yields a negative result that is implicitly cast to an unsigned `size_t`, causing the `memcpy` call to read an excessively large amount of data and expose memory contents beyond the intended buffer. This out‑of‑bounds read can leak sensitive information and, if combined with other weaknesses, may lead to denial of service or more severe exploitation. The CVSS score of 6.5 indicates a moderate impact on confidentiality and potentially disrupts service.

The flaw affects the open source OpenEXR library maintained by the AcademySoftwareFoundation. Vulnerable releases include versions 3.3.0 through 3.3.6 and 3.4.0 through 3.4.4. These versions can be found in the official distribution under the package name openexr. Subsequent releases, 3.3.7 and 3.4.5 and later, contain the patch.

The CVSS base score of 6.5 represents moderate severity, and the EPSS probability of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no known public exploits. Based on the description, the most likely attack scenario is local exploitation by providing a crafted EXR file to an application that uses the library through a memory‑mapped IStream. If such an application accepts network‑supplied files, a remote attacker could potentially trigger the overflow, leading to information disclosure, denial of service, or a broader compromise if additional flaws exist. No additional context is given about the need for elevation or privileged execution, so the impact is confined to the execution context of the affected program.