This vulnerability is a heap out‑of‑bounds read that occurs during Run‑Length‑Encoding (RLE) decoding in OpenEXRCore. A crafted RLE‑compressed EXR file can make the 64‑bit unpacked size truncate before allocation, leading the unpack_32bit function to read beyond the allocated buffer. The out‑of‑bounds read does not provide code execution but can terminate the parsing process or corrupt memory in a way that causes the application to crash, resulting in a denial of service. The weakness is classified as CWE‑125.

The flaw affects the AcademySoftwareFoundation OpenEXR library on ILP32 (32‑bit) builds for versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. It has been fixed in releases 3.2.11, 3.3.13, and 3.4.14 and later versions for all supported architectures.

The CVSS score is 5.5, indicating moderate severity. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of public exploitation at this time. The attack requires an attacker to supply a maliciously crafted EXR file that is processed by an application using the vulnerable OpenEXR library on ILP32 platform. Depending on the application, this could be a local attack if the user can cause the application to load a file, or a remote attack if the application accepts external EXR input (for example, an image uploaded to a web service). The flaw cannot be exploited to execute arbitrary code but can be used to disrupt availability by crashing the target process.