The vulnerability is a buffer overflow that occurs when processing deep EXR files with a nonzero dataWindow origin. A crafted file can cause OpenEXR to return an out‑of‑bounds pointer from TypedDeepImageChannel::row(), which can lead to a crash and, in certain circumstances, the disclosure of limited memory contents. The flaw is caused by the combination of zero-based row access with an absolute‑coordinate‑adjusted base pointer, revealing a logic error in the library’s deep‑image handling. The identified weaknesses are Integer Overflow (CWE‑190) and Buffer Overflow (CWE‑787).

The affected product is AcademySoftwareFoundation’s OpenEXR. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable. The fixed release is 3.4.14 (with earlier 3.2.11 and 3.3.13 also containing the fix).

The CVSS score of 7.1 indicates a high risk of impact, but the EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed as a known exploitable vulnerability in the CISA KEV catalog. The flaw can be triggered by feeding a maliciously crafted EXR file to any application that uses OpenEXR to load deep images, suggesting the likely attack vector is local file processing, though a remote exploitation path could exist if the library is embedded in a network‑accessible service.