OpenEXR contains a signed integer overflow in the undo_pxr24_impl function of the PXR24 decompression routine, which can lead to a bounds‑check bypass. The overflow occurs when a large value for the width parameter is multiplied by three as a signed 32‑bit integer before being cast to an unsigned 64‑bit value; this undefined behavior can wrap to a small positive number. If the bounds check is incorrectly satisfied, the decompression loop writes pixel data beyond the allocated output buffer, allowing an attacker to corrupt memory and potentially achieve arbitrary code execution. The weakness is characterized as a signed integer overflow (CWE‑190) and out‑of‑bounds write (CWE‑787).

The vulnerability affects OpenEXR releases from version 3.2.0 up through, but not including, 3.2.7, and analogously from 3.3.0‑3.3.8 and 3.4.0‑3.4.8. The only vendor listed is the Academy Software Foundation, maintaining the openexr library.

The CVSS base score of 5.9 indicates moderate to high risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not registered in CISA’s KEV catalog, implying no known active exploitation. Based on the description, the likely attack vector is the processing of a crafted EXR file by an application that incorporates the vulnerable OpenEXR library, which could be local or remote depending on the application’s exposure to untrusted input.