The vulnerability exists in the PyOpenEXR Python bindings of the OpenEXR library. When a deep EXR file declares a literal channel named left along with layer-prefixed RGB channels left.R, left.G, and left.B, the library misallocates a scalar deep sample array for the literal channel and then reuses the same array for the RGB group. The RGB stride (three lanes) written into the scalar-shaped storage overruns the allocation, resulting in an out-of-bounds write and heap buffer overflow during deep sample decoding. This triggers memory corruption and likely crashes the application using the default Python API to open the file.

The flaw affects the Academy Software Foundation’s OpenEXR library, specifically the PyOpenEXR bindings in versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13. Versions 3.3.13 onward and 3.4.14 onward have been patched.

The CVSS score of 5.5 indicates moderate severity. Exploitation requires a crafted deep scanline EXR file and use of the default PyOpenEXR public API, therefore the attack vector is likely local or requires the ability to supply such a file to a target application. The vulnerability conforms to CWEs 122 and 787, yielding a heap-based buffer overflow and out-of-bounds write. The EPSS score is not available and the issue is not listed in CISA's KEV catalog, suggesting that widespread exploitation has not yet been documented.