A vulnerable version of the exrmultiview utility can write beyond the bounds of a heap allocation when it merges two separately valid EXR files whose union dataWindow is misaligned to a view’s channel subsampling. The flaw is a classic bounds checking error (CWE‑122, CWE‑787) that may corrupt arbitrary memory, potentially leading to data corruption, crashes, or other unintended behavior. The issue is triggered by standard public‑tool commands and is not limited to a specific API or environment.

The Academy Software Foundation’s OpenEXR library is affected in all releases before 3.2.11, 3.3.13, and 3.4.14. The problematic component is the exrmultiview tool, which is part of the OpenEXR distribution for processing EXR image files in the motion‑picture industry.

The CVSS score of 7.1 reflects a fairly high severity for a typical desktop or server utility. EPSS data are currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation at this time. The likely attack path involves an adversary crafting or corrupting two EXR scanline files that, when processed together by exrmultiview, cause a heap overflow. While the tool is typically run locally, the vulnerability could be exploited by an attacker with file‑write permissions on a system that automatically processes EXR files, or by a malicious user leveraging server‑side script interactions that invoke exrmultiview.