Technical impact
The vulnerability in the OpenEXR library’s Imf_4_0::SampleCountChannel::set method causes a heap out‑of‑bounds write when the row‑based sample‑count setter incorrectly uses dataWindow.min.x instead of dataWindow.min.y. This logic flaw allows a valid row index for deep images where min.x differs from min.y to translate into an invalid Y coordinate, writing before the allocated _numSamples buffer. The resulting heap corruption can lead to crashes and, depending on context, potentially compromise memory integrity. No remote code execution is explicitly documented in the CVE description.
Affected Systems
The affected product is the Academy Software Foundation’s OpenEXR library. Versions prior to 3.2.10, 3.3.12, and 3.4.13 contain the flaw. Users of these versions who create or process deep EXR files through the OpenEXRUtil DeepImage API are at risk. Fixes are available in the stated releases.
Risk and Exploitability
The CVSS score of 6.1 classifies the vulnerability as moderate severity. The EPSS score indicates a very low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is exercised via the public DeepImage API, an attacker who can supply a crafted deep EXR file could trigger the out‑of‑bounds write. Although no active exploits have been reported, the nature of the heap corruption warrants caution for systems that routinely process untrusted EXR content.
