AIKIDO-2026-182055

TL;DR

On ILP32 builds, OpenEXRCore RLE decode multiplies or accumulates attacker-controlled dimension and sample fields with 32-bit arithmetic before allocating decode buffers. A crafted RLE-compressed EXR can overflow those size computations, produce an undersized buffer, and trigger a heap out-of-bounds read and denial of service. Typical 64-bit builds are not affected. The fix rejects oversized size computations before allocation.