Technical impact
A signed integer overflow occurs in OpenEXRCore's unpack_sample_table() when decoding a crafted deep tiled EXR file. The overflow produces an invalid pointer that leads to a read from an unmapped memory address and a crash. The vulnerability is a classic Integer Overflow flaw (CWE‑190) and results in a denial‑of‑service condition rather than code execution or data disclosure.
Affected Systems
The flaw affects AcademySoftwareFoundation OpenEXR library versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. Any application that uses these versions to decode deep tiled EXR images is affected. The issue is fixed in OpenEXR 3.2.11, 3.3.13, and 3.4.14.
Risk and Exploitability
The CVSS score of 5.5 indicates a moderate severity. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation. The likely attack vector is via a crafted deep tiled EXR file; an attacker could supply such a file to any program that decodes deep tiled images, causing it to crash and potentially leading to a denial‑of‑service. The vulnerability is exploitable in a local or remote context depending on whether the application accepts user supplied images.
