OpenEXR’s internal wavelet decoding routine can overflow a signed 32‑bit counter when processing a specially crafted EXR file. The resulting wraparound causes the decoder to reference an incorrect memory location, leading to out‑of‑bounds reads and writes. In a system where the OpenEXR library is linked, this memory corruption can corrupt data, crash the application, or potentially enable arbitrary code execution if an attacker can supply malicious input.

The critical versions are all releases from 3.1.0 up to, but not including, 3.2.7; all releases from 3.3.0 up to, but not including, 3.3.9; and all releases from 3.4.0 up to, but not including, 3.4.9 of the AcademySoftwareFoundation OpenEXR library. All other newer releases are unaffected.

The vulnerability has a CVSS score of 8.6, indicating high severity, while the EPSS score is below 1 % and the issue is not listed in the CISA KEV catalog. Attackers would need to supply a malicious EXR file to a vulnerable application that uses OpenEXR; thus the attack vector is local or via supply‑chain file ingestion rather than remote exploitation. Exploitation requires the vulnerable library to be loaded and the user to have read access to the crafted file.