The vulnerability is an integer overflow in the HTJ2K decoder of OpenEXR’s core library. During decoding of a crafted HTJ2K‑compressed EXR file, the decoder multiplies the channel width by the number of bytes per element using 32‑bit signed arithmetic. For very large widths (e.g., >= 536,870,912 bytes for FLOAT data), the multiplication overflows, producing a corrupted offset that is later used in pointer arithmetic and can cause a heap out‑of‑bounds write. This is an instance of CWE‑190 (Integer Overflow) leading to a CWE‑787 (Out‑of‑Bounds Write). The resulting heap corruption may allow an attacker to corrupt memory and potentially execute arbitrary code or cause a denial‑of‑service.

The flaw affects the Academy Software Foundation OpenEXR library, versions 3.4.0 through 3.4.11. Any software or pipeline that decodes HTJ2K‑compressed EXR files—such as motion‑picture editing tools or rendering engines—running these versions is vulnerable. The issue has been fixed in OpenEXR 3.4.12; upgrading to that version or later eliminates the risk.

The CVSS score of 6.1 indicates moderate severity. Although the EPSS score is not available and the vulnerability is not listed in CISA KEV, the attack can be performed by supplying a malicious EXR file to a vulnerable decoder, which is a common pattern in file‑processing libraries. Exploitation requires that the target application uses the affected OpenEXR version to decode a crafted file; there is no requirement for privileged access. Therefore, the risk is present in environments where untrusted image files are processed.