AIKIDO-2026-10499

TL;DR

Affected versions of this package are vulnerable to out-of-bounds memory access in the PIZ decompression path due to signed integer overflow when advancing the wavelet buffer pointer. The decoder updates the working pointer using nx * ny * wcount computed with signed 32-bit arithmetic, which can overflow for crafted image dimensions and cause the pointer to wrap to an incorrect location. Subsequent wavelet decoding then operates in place on this invalid address, resulting in both out-of-bounds reads and writes. An attacker able to supply a specially crafted EXR file can trigger memory corruption and crashes during decoding.