OpenEXR, widely used in motion‑picture pipelines, contains a flaw in versions prior to 3.2.11, 3.3.13, and 3.4.14. A crafted EXR file that sets a non‑zero dataWindow.min can cause the TypedFlatImageChannel::row() function to return an invalid heap pointer. When an application subsequently writes image rows via FlatHalfChannel::row(), the invalid pointer leads to out‑of‑bounds memory writes or use‑after‑free writes. Based on the description, it is inferred that this heap corruption could allow an attacker to crash a program, corrupt data, or potentially execute arbitrary code.

The vulnerability affects the AcademySoftwareFoundation OpenEXR library. Any application that loads and processes EXR images using FlatHalfChannel::row(), such as image converters, rendering engines, or pipeline components in production, is at risk if the library versions are within the vulnerable ranges. Executable use of untrusted EXR files requires updating to a patched release.

The CVSS score of 7.1 reflects a high impact on integrity. Based on the description, it is inferred that the vulnerability could potentially be exploited remotely. The EPSS score is not available, so no current estimate of exploitation probability can be provided, but attackers can trigger the flaw by supplying a crafted file to any system that accepts EXR input. The vulnerability is not yet present in CISA’s KEV catalog, though it has the characteristics of a heap OOB write that can lead to arbitrary code execution. The attack path requires user or attacker control over the EXR file, which is likely in many distributed workflows, making the risk significant for exposed services.