OpenEXR performs curc->width*curc->height in internal_dwa_compressor.h:1722 using 32‑bit signed arithmetic without a cast, causing an integer overflow that miscalculates the buffer size for DWA compression. This overflow can result in writes beyond the allocated buffer, enabling an attacker who can supply a crafted EXR file to corrupt memory or potentially execute arbitrary code. The weakness is labeled CWE‑190.

The Academy Software Foundation’s OpenEXR library versions 3.2.0 to 3.2.7, 3.3.0 to 3.3.9, and 3.4.0 to 3.4.9 are vulnerable. The fix is included in releases 3.2.8, 3.3.10, and 3.4.10.

With a CVSS score of 8.4 the vulnerability is high severity. The EPSS score is not available, so exact exploit probability cannot be assessed, and the vulnerability is not listed in CISA KEV, indicating no known public exploitation. The vulnerable code is invoked when parsing EXR files, so the likely attack vector involves a malicious image supplied to the application. If the application runs with elevated privileges, the potential impact extends to full system compromise.