The flaw is an out‑of‑bounds read inside OpenEXR’s IDManifest::init() routine during prefix expansion. The code assumes a two‑byte prefix when the preceding string exceeds 255 bytes, but it does not verify the length of the current string before accessing the first two bytes. This can allow a crafted EXR file to cause the library to read beyond the valid buffer, potentially exposing data from adjacent memory or causing a crash. The vulnerability is limited to read operations, but it can lead to information leakage or denial of service.

Academy Software Foundation’s OpenEXR library version 3.0.0 through 3.2.8, 3.3.0 through 3.3.10, and 3.4.0 through 3.4.10 are affected. The patches were fixed in OpenEXR 3.2.9, 3.3.11, and 3.4.11, respectively.

The flaw carries a CVSS score of 8.8, indicating high severity, yet it is only exploitable when an application parses a maliciously crafted EXR file. Because the vulnerability is local to the input data, the attack vector is primarily limited to environments where the victim opens an untrusted file. No exploit evidence has been published and the EPSS score is unavailable, suggesting low to moderate exploitation probability. The vulnerability is not listed in the CISA KEV catalog.