The vulnerability stems from a signed 32‑bit integer overflow in the PIZ wavelet decoder routine of OpenEXR. The internal_exr_undo_piz function advances a wavelet pointer using signed 32‑bit arithmetic with dimensions represented as int. An attacker can craft an EXR file that causes this counter to wrap, leading the decoder to operate on an incorrect address. Because the decode path processes data in place, this results in both out‑of‑bounds reads and writes, enabling arbitrary memory corruption that could compromise program integrity or confidentiality.

Affected is the AcademySoftwareFoundation OpenEXR library across versions 3.1.0 through before 3.2.7, 3.3.9, and 3.4.9. Any software that incorporates these versions—such as motion‑picture industry pipelines that use EXR for high‑dynamic‑range imagery—may be vulnerable when processing crafted files.

With a CVSS score of 8.6 the vulnerability is classified as high severity. The EPSS score is not reported and the issue is not listed in the CISA KEV catalog, indicating that large‑scale exploitation has not yet been documented. The likely attack vector is the delivery of a malicious EXR file through any medium that allows the application to read a file, as the payload is fully contained within the file (inferred). Because the flaw permits arbitrary memory reads and writes, a compromised process could potentially lead to privilege escalation or arbitrary code execution, although such exploitation is not directly described in the advisory.