Technical impact
The vulnerability resides in the SampleCountChannel component of OpenEXR. The roundListSizeUp() helper repeatedly left‑shifts an unsigned 32‑bit number to round a sample‑list size up to the next power of two. When the requested size is the maximum unsigned value, the shift overflows at 0x80000000, producing 0, which remains less than the requested size and causes an infinite loop in endEdit(). This loop never exits, consuming CPU continuously and effectively denying service. The weakness is categorized as integer overflow, unchecked input size, and an infinite loop under CWE‑190, CWE‑400, and CWE‑835.
Affected Systems
The OpenEXR library distributed by the Academy Software Foundation is affected. Every release prior to 3.2.10, 3.3.12, and 3.4.13 is vulnerable. Applications that process EXR images containing a sample count of 4,294,967,295 (UINT_MAX) can trigger the exploit if they use these libraries. The library is commonly integrated into visual effects pipelines and media processing applications in the motion picture industry, so any software that links against the affected versions and processes untrusted EXR content is at risk.
Risk and Exploitability
The CVSS score of 6.2 indicates medium severity, the EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The flaw is reachable through publicly exposed OpenEXRUtil APIs, so an attacker can supply a crafted EXR file that triggers the infinite loop. The likely attack vector is a remote request that causes an application to ingest a malicious EXR image—such as through an image upload endpoint, a media ingestion service, or a plugin that processes user‑supplied graphics. If an application ingests untrusted EXR content, the result could be a denial of service that monopolizes CPU resources. The attack requires no special privileges.
