Technical impact
A crafted HTJ2K‑compressed EXR can cause the OpenEXR library to crash by writing beyond the bounds of a stack buffer in its vendored OpenJPH AVX2 decoder. The flaw originates from allowing SIZ fields with image‑offset or tile‑grid geometry that places the first tile outside the visible image area. The resulting out‑of‑bounds write leads to a crash or denial of service when the library decodes such a file.
Affected Systems
The vulnerability impacts the AcademySoftwareFoundation OpenEXR library versions 3.4.0 through 3.4.13. These releases perform HTJ2K decoding but fail to reject SIZ configurations that do not intersect the image, ultimately triggering the stack overflow. Versions 3.4.14 and later contain the fix and are not affected.
Risk and Exploitability
The CVSS score of 6.5 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is the delivery of a malicious HTJ2K‑compressed EXR file to any application that uses the affected OpenEXR library. Exploitation requires decoding the crafted file, which most commonly occurs in media handling or rendering pipelines. Because the flaw only triggers a crash, there is no evidence of remote code execution from the current description.
