A signed 32‑bit integer overflow occurs in the JPEG2000 input handler when calculating the buffer size from image dimensions, channels, and bit depth. The resulting wrap‑around yields an undersized allocation, and subsequent pixel writes overflow the heap. This vulnerability maps to CWE‑190 and can corrupt memory, leading to crashes, denial‑of‑service, or potentially arbitrary code execution if the corrupt data can be controlled by an attacker.

The flaw is present in OpenImageIO releases prior to 3.0.18.0 and 3.1.13.0, as distributed by the AcademySoftwareFoundation. It only manifests in builds compiled with the USE_OPENJPH flag enabled, which handles JPEG2000 (OpenJPH) files.

The CVSS score of 7.1 indicates a high severity impact under the Common Vulnerability Scoring System. EPSS is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply a JPEG2000 image with dimensions that overflow the signed 32‑bit multiplication; if the application processes such images from an untrusted source, the overflow could be triggered remotely or locally.