OpenEXR’s CompositeDeepScanLine::readPixels uses attacker‑controlled counts to accumulate per‑pixel totals, which wrap modulo 2^32. The wrapped totals are later used to resize sample buffers. When the actual sample counts exceed the resized buffer size, a heap out‑of‑bounds write occurs. This memory corruption can allow an attacker to overwrite arbitrary heap data and potentially execute arbitrary code.

The vulnerability affects the AcademySoftwareFoundation OpenEXR implementation. Versions prior to v3.2.6, v3.3.8, and v3.4.6 are vulnerable. The fix is included in those releases and in all subsequent OpenEXR releases.

The CVSS score of 8.4 classifies the flaw as high severity. The EPSS score of < 1% indicates that, as of this analysis, exploitation is unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires crafting a malicious EXR file that triggers the over‑run during the CompositeDeepScanLine pixel read process. It thus likely depends on an attacker’s ability to provide a file to a vulnerable application that processes OpenEXR images; it is not a publicly accessible remote code execution vector but could be used in local or privilege‑escalation scenarios if the application runs with elevated rights.