A heap information‑disclosure flaw exists in the PXR24 decompression routine of the OpenEXR image library. When an application decodes a specially crafted EXR file, the library can read beyond the intended buffer and return portions of the heap to the caller. The exposed data is returned as part of the decoded pixel values, allowing an attacker to recover arbitrary memory contents belonging to the process using the library. The weakness originates from a lack of validation of the decompressed size against the original data length, constituting information exposure through overreading.

The exploit affects the Academy Software Foundation’s OpenEXR implementation from version 3.4.0 through 3.4.7 inclusive. Any software that embeds these releases and uses the default PXR24 decoder is susceptible. The issue was addressed in release 3.4.8; systems using that or later versions are no longer impacted.

The vulnerability receives a score of 8.7 on the security rating scale, classifying it as high severity. The probability of exploitation is estimated to be below 1%, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can trigger the flaw by delivering a malicious EXR file to the target application without user interaction. The impact is data theft of sensitive information residing in the process heap, which could include credentials, cryptographic keys, or other secrets. Because any process that loads the library is affected, the scope extends from a single user to the entire application and potentially related services that rely on image decoding.