OpenEXR versions 3.4.0 through 3.4.7 allow a crafted B44 or B44A EXR file to trigger an integer overflow during decompression, resulting in an out‑of‑bounds write in any application that decodes the file. This flaw can cause the application to crash or corrupt adjacent heap allocations, potentially leading to data loss or denial of service.

The vulnerability affects the AcademySoftwareFoundation OpenEXR library, specifically all releases prior to 3.4.8. Any program that uses exr_decoding_run to load B44 or B44A images from external sources is at risk.

The CVSS score of 8.4 signals a high severity flaw, while the EPSS probability is under 1% and it is not listed in the KEV catalog. The likely attack vector is an attacker supplying a malicious EXR file to a vulnerable application; the exploit requires the file to be processed, so it can be considered a file‑based local or remote vulnerability depending on the application’s context.