A crafted tiled EXR file can trigger a heap out‑of‑bounds write in the OpenEXR library when accessed through the public TiledRgbaInputFile RGBA API. The vulnerability is caused by an integer overflow in the array buffer size calculation for 32‑bit (ILP32) builds, which allocates a buffer that is far smaller than needed and allows subsequent tile decode operations to write past the end of the allocation. This memory corruption can potentially lead to arbitrary code execution or program crashes if an attacker controls the EXR file contents.

The vulnerability affects OpenEXR releases prior to 3.2.11, 3.3.13, and 3.4.14 on 32‑bit (ILP32) systems. Applications using any of the affected versions and processing tiled EXR files with tile dimensions of 65537×65537 on a small 40×40 data window are at risk.

The CVSS score of 7.1 indicates a high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a specially crafted EXR file to a vulnerable binary running on a 32‑bit build. While the crash likelihood is high, required conditions (ILP32 platform, vulnerable OpenEXR version, and malformed EXR input) reduce the probability of a widespread automated exploitation. Nonetheless, the potential impact of memory corruption warrants prompt attention.