A deep image file with a non‑zero dataWindow origin can cause the OpenEXRUtil TypedDeepImageChannel<T>::row() API to return a pointer that points outside of the allocated buffer. This out‑of‑bounds read may crash an application or, under a predictable heap layout, leak data from the heap, representing a potential information disclosure. The vulnerability stems from a mismatch between absolute and logical coordinate handling within the library and is documented as CWE‑125.

The issue affects OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12 from the Academy Software Foundation. Those product releases are vulnerable; later releases (3.3.13 and 3.4.13 onward) contain the fix.

The CVSS score of 7.1 classifies the vulnerability as a medium‑high severity, and the EPSS score is not available at this time. It is not listed in the CISA KEV catalogue. The likely attack vector is the delivery of a malicious deep‑image file that an application or library processes; the attacker does not need elevated privileges but requires that the target load the crafted file. Exploitation conditions are simple—an impacted library processed with a deep image holding a dataWindow origin different from zero, leading to an OOB read.