The flaw is a signed integer overflow in the ht_undo_impl() function of OpenEXR’s HTJ2K decompression path. When a crafted EXR file containing 16,385 FLOAT channels at the maximum width of 32,767 is processed, the 32‑bit signed counter for bytes‑per‑line overflows, turning into a negative value. That negative value is then used to advance a per‑scanline pointer, producing a heap out‑of‑bounds write. The overflow is type CWE‑190 and can lead to memory corruption that, if exploited, could compromise application integrity or enable arbitrary code execution.

All installations of the AcademySoftwareFoundation OpenEXR library version 3.4.0 through 3.4.9 are vulnerable. Version 3.4.10 and later contain a remediation that addresses the integer overflow in internal_ht.cpp and removes the risk discussed here.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploitation at this time. An attacker would need to supply a specifically crafted EXR file, and the host must have sufficient memory for a ~64 GB allocation to trigger the overflow; on memory‑constrained hosts the allocation fails before the vulnerable code is reached. While the conditions reduce exploitation likelihood, the potential impact warrants timely mitigation.