The vulnerability arises from a signed 32‑bit integer overflow in the pixel-loop index expression used by ConvertCbYCrYToRGB() when decoding DPX 4:2:2 files. The overflow causes the computed index to become a large negative value, which the code then uses to write to the output buffer. Because the buffer pointer moves outside its allocated bounds, the write corrupts heap memory and crashes the process. The vulnerability is classified as a memory corruption flaw (CWE‑190) that also manifests as an out‑of‑bounds write (CWE‑787). The impact is a denial‑of‑service condition; if an attacker can supply a crafted DPX file, they can force an application that relies on OpenImageIO to crash.

The affected vendor is the Academy Software Foundation, and the product is OpenImageIO. Versions prior to 3.0.18.0 in the 3.0 line and prior to 3.1.13.0 in the 3.1 line contain the flaw. The issue exists in the DPX 4:2:2 decoder component and affects any installation that uses that decoder. No other product lines or vendors are listed as affected.

The CVSS score of 8.8 indicates high severity. While no EPSS score is available, the lack of a KEV listing suggests no publicly known exploitation yet. However, the flaw can be triggered by any process that parses a malicious DPX file, so an attacker with the ability to supply such a file can cause a crash. The exploitation path requires only a crafted file, so the vulnerability is likely to be leveraged locally through a supply chain or a user‑initiated import. Administrators should treat it as a high-risk issue pending patch.