CyberRota Analysis
AI-GeneratedOpenEXR versions prior to 3.2.11, as well as 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, are vulnerable to an out-of-bounds pointer access due to improper handling of nonzero dataWindow origins in the TypedDeepImageChannel::row() function. This flaw can lead to application crashes or potential information disclosure, posing a significant risk to users in the motion picture industry who rely on this image format. Organizations utilizing affected versions should prioritize upgrading to the patched releases (3.2.11, 3.3.13, or 3.4.14) to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.