An out-of-bounds read occurs in the SampleCountChannel::row() function of the OpenEXRUtil library when a deep image has a data window whose origin is non‑zero. The API is documented as 0‑based, but internally it offsets the base for absolute pixel coordinates; when dataWindow.min is non‑zero the computed address can point to memory outside the allocated sample‑count buffer. The resulting read can crash the application or, in a heap layout controlled by an attacker, leak adjacent heap memory to the caller. This vulnerability is limited to the read phase and does not grant code execution by itself but can expose sensitive data or enable denial‑of‑service attacks.

The vulnerability affects the Academy Software Foundation's OpenEXR library in the following released versions: 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. Versions 3.2.11, 3.3.13, and 3.4.14 contain the fix and are not impacted.

With a CVSS score of 7.1, the vulnerability is considered high severity. The EPSS score is not available, but the lack of public exploitation evidence and the absence of KEV listing suggest a moderate likelihood of exploitation. Attackers must supply a malicious deep EXR file that contains a non‑zero data window origin; an application that opens such a file and calls SampleCountChannel::row() will experience the out‑of‑bounds read. The impact is confined to memory disclosure or crash, and exploitation requires the target application to use the affected API directly.