A signed integer overflow in OpenEXR’s generic_unpack() occurs when a crafted EXR file sets the dataWindow.min.x field to a large negative value, causing the library to compute an excessively large image width. The overflow propagates to a signed integer multiplication that triggers a SIGILL, terminating the process. This weakness is classified as CWE-190 and results in a denial‑of‑service condition for any application that loads the malformed file.

The vulnerability affects the Academy Software Foundation’s OpenEXR product in the 3.4.0 through 3.4.8 releases. Anyone using these firmware versions in image processing or media pipelines is exposed, including movie‑producing applications that rely on OpenEXR for HDR image storage.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to successfully deliver a malicious EXR file to an application that processes it, which is plausible in scenarios involving user‑supplied media but is not considered a widespread attack vector at present. The impact remains confined to a crash rather than code execution.