The vulnerability is an integer overflow in the HTJ2K decoder of OpenEXR. A malicious .exr file that uses HTJ2K compression and sets a channel width of 32768 can cause the decoder to calculate a buffer size that is too small. The overflow causes the program to write controlled data beyond the allocated heap buffer. This out‑of‑bounds write can overwrite arbitrary heap memory, providing a write primitive that can be leveraged to execute arbitrary code. The weakness is a buffer overflow, signed integer overflow, and arithmetic error as indicated by the associated CWEs.

OpenEXR versions 3.4.0 through 3.4.6 are affected. Any application that links against these library releases and decodes .exr files containing HTJ2K compressed data is at risk. The issue was addressed in OpenEXR 3.4.7, which introduces bounds checks that prevent the overflow.

The CVSS score of 8.4 indicates high severity, and the EPSS score of less than 1% suggests exploitation probability remains low at present. The vulnerability is not listed in CISA’s KEV catalog, so it is not currently known to be actively exploited. The likely attack vector requires delivery of a crafted .exr file to the vulnerable application; if the application parses files from an untrusted source, the attacker could gain remote code execution by controlling the heap layout. The impact includes potential compromise of confidentiality, integrity, and availability of the affected system.