A crafted uncompressed deep‑tile EXR triggers an out‑of‑bounds read in OpenEXR's DeepTiledInputFile sample‑count table decoding on ILP32 builds. The calculation of the sample‑count table size wraps, which causes unpack_sample_table() to read beyond the buffer. This results in a denial of service by corrupting memory or crashing the application. The flaw is a classic CWE-125 out‑of‑bounds read.

The Academy Software Foundation's OpenEXR library, specifically versions prior to 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, on ILP32 architectures. These are used in motion‑picture pipelines that embed deep‑tile EXR images.

The CVSS score of 5.5 indicates a moderate severity. EPSS information is unavailable, and the vulnerability is not listed in CISA's KEV. The flaw is likely exploitable by an attacker who can supply a malicious deep‑tile EXR file, implying a local or remote file‑processing attack vector. Because the vulnerability manifests as a denial of service rather than code execution, the impact is confined to availability and does not compromise confidentiality or integrity.