The vulnerability arises in OpenEXR when decoding a B44‑compressed scanline on ILP32 (32‑bit) builds. An attacker can supply an EXR file with a crafted B44‑compressed section that causes the logical scratch buffer size to be truncated before the library allocates memory. The subsequent uncompress operation writes beyond the allocated buffer using an attacker‑controlled channel width, resulting in an out‑of‑bounds write. The primary impact is memory corruption that can lead to denial of service, as the library may crash or misbehave when processing the file.

Affected are the AcademySoftwareFoundation OpenEXR product on ILP32 systems. Vulnerable version ranges are 3.1.0‑3.2.10, 3.3.0‑3.3.12, and 3.4.0‑3.4.13. The fix is released in 3.2.11, 3.3.13, and 3.4.14. These ranges include both the base library and any bundled binaries that perform image decoding.

The CVSS score of 5.5 indicates moderate severity. EPSS is not available, so historical exploitation data is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the application to process an EXR image supplied by an attacker; thus the attack surface is limited to programs that accept user‑controlled images, such as media tools, visual effects pipelines, or services that expose image upload functionality. While remote exploitation through a network service is possible if such a service imports EXR files, many installations run the library in a privileged context or on local machines, reducing the risk. Still, given the possibility of denial of service and arbitrary memory overwrite, a conservative approach is advisable.