This vulnerability arises from the DWA lossy decoder in the OpenEXR library. When decoding images with a sufficiently large component width, signed 32‑bit arithmetic overflows while calculating temporary block pointers. The overflow results in a pointer that wraps around, allowing the decoder to write beyond the bounds of the allocated heap memory. Such memory corruption can crash the application or, depending on the surrounding context, be leveraged to inject malicious code or alter program behavior. The weakness is reflected in CWE‑190 (integer overflow) and CWE‑787 (buffer overflow).

The flaw affects AcademySoftwareFoundation OpenEXR versions 3.2.0 through 3.2.6, all versions before 3.3.9, and before 3.4.9. Versions 3.2.7, 3.3.9, and 3.4.9 contain the fix and are therefore not vulnerable.

The CVSS score of 8.4 classifies this as high severity. Since the vulnerability is triggered by processing a crafted EXR file, it can be exploited when an application loads untrusted images. The absence of an EPSS score and the lack of listing in the CISA KEV catalog suggest that exploitation is currently theoretical, but the high CVSS indicates that an attacker who gains the ability to supply an image can potentially cause denial of service or arbitrary code execution. The likely attack vector is through maliciously crafted image files delivered via local or remote channels to software that incorporates the vulnerable OpenEXR library.