An integer overflow occurs in the ImageChannel::resize method of OpenEXR, which can lead to a heap out‑of‑bounds write when the exposed OpenEXRUtil public API is used. This results in memory corruption that may compromise the stability or confidentiality of the consuming application. The flaw is an instance of CWE‑190 and is documented with a CVSS score of 8.8, indicating a high severity.

The vulnerability affects the AcademySoftwareFoundation OpenEXR library in releases 3.0.0 through 3.2.8, 3.3.0 through 3.3.10 and 3.4.0 through 3.4.10. These versions are commonly integrated into motion‑picture production workflows, compositing suites, and image‑processing tools that accept EXR files.

The CVSS analysis classifies the issue as high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker can supply a carefully crafted EXR file to any application that invokes the OpenEXRUtil API; no authentication, privilege escalation or additional conditions are required, making the abuse straightforward for systems that process untrusted EXR content. The potential for severe exploitation is therefore significant for affected deployments.