AIKIDO-2026-10333

TL;DR

Affected versions of this package contain a flaw in istream_nonparallel_read where incorrect bounds handling during stream reads can lead to improper size adjustment when nread + sz exceeds the stream size, potentially producing a negative or incorrect length. An attacker controlling a crafted file or input stream could manipulate the offset and requested size so the resulting calculation underflows or bypasses expected bounds, leading to out-of-bounds reads or memory corruption. By supplying a maliciously structured OpenEXR file or stream that triggers the faulty size logic, the attacker may cause the application to read invalid memory regions, potentially resulting in denial of service or further memory-safety exploitation depending on downstream usage of the buffer.