Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-25T18:17:56.747Z",
  "pubdate": "2026-08-25T18:17:56.747Z",
  "executiveSummary": "OpenEXR is susceptible to an out-of-bounds pointer vulnerability residing within the TypedDeepImageChannel::row() function. This flaw arises from improper coordinate handling when processing deep EXR files containing a non-zero dataWindow origin. By exploiting this discrepancy between zero-based indexing and absolute-coordinate-adjusted base pointers, an attacker can trigger an out-of-bounds memory access.\nThe vulnerability affects OpenEXR versions prior to 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. Successful exploitation allows an attacker to cause a process crash (Denial of Service) or potentially achieve limited information disclosure, depending on the memory layout and the specific crafting of the malicious EXR file. The attack requires no authentication or specific user privileges, as it is triggered during the parsing of a maliciously formatted image file by an application utilizing the affected OpenEXR libraries. This represents a significant risk for systems handling untrusted image data in professional visual effects pipelines.",
  "technicalDetails": "The vulnerability is located in the TypedDeepImageChannel::row() function within the OpenEXR implementation. The root cause of the defect is a logical mismatch in memory address calculation when the input EXR file specifies a non-zero dataWindow origin. In a standard EXR structure, the dataWindow defines the region of the image containing pixel data, which may not start at the (0,0) coordinate relative to the displayWindow.\nThe library attempts to calculate the memory address for a specific row by combining a zero-based row index—typically expected by the internal API—with an base pointer that has been adjusted for the image's absolute coordinate system. When the dataWindow origin is non-zero, the adjustment logic fails to correctly normalize the pointer offset. This leads to the generation of a pointer that addresses memory outside the intended buffer allocated for the deep image channel.\nThe exploitation flow proceeds as follows: First, an attacker constructs a maliciously crafted deep EXR file where the dataWindow header attributes are manipulated to contain a non-zero origin. Second, the target application invokes the TypedDeepImageChannel::row() function while attempting to access or parse the deep pixel data. Third, due to the faulty pointer arithmetic, the function calculates an out-of-bounds memory address. Finally, when the application attempts to read from or write to this pointer, it triggers either a segmentation fault (leading to a crash) or accesses sensitive data adjacent to the heap-allocated image buffer.\nThis vulnerability is classified as an out-of-bounds read/write issue. The exploit does not require authentication or elevated privileges, as it is dependent on the parsing of a malformed file. The scope of impact is limited by the distance of the calculated pointer from the original buffer, but given the nature of image processing buffers, this may lead to controlled memory corruption or the exposure of data residing in heap memory. The issue is persistent across the affected version ranges: <3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13. The vulnerability is triggered during the routine execution of standard image decoding workflows, requiring no complex network interaction beyond the delivery of the malicious file to the processing system."
}