The vulnerability arises in the DWA lossy decoder of OpenEXR, where signed 32‑bit arithmetic is used to compute temporary per‑component block pointers. For a sufficiently large image width, the calculation overflows and the decoder later writes to a wrapped pointer outside the allocated rowBlock backing store. This results in a heap out‑of‑bounds write that can corrupt memory, potentially leading to crashes or, depending on the context, arbitrary code execution. The weak point is a classic signed integer overflow combined with a subsequent out‑of‑bounds write.

Affected versions are OpenEXR 3.2.0 up to but excluding 3.2.7, 3.3.9, and 3.4.9. The open source reference implementation from the Academy Software Foundation is impacted; the issue was fixed in releases 3.2.7, 3.3.9, and 3.4.9.

The CVSS score of 8.4 indicates a high severity vulnerability. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting low current exploitation probability. However, the attack vector is likely local or remote file‑processing; a malicious or compromised image file with a large width can trigger the overflow. Exploitation requires crafting a DWA‑encoded EXR file and delivering it to a vulnerable application that processes untrusted images.