AIKIDO-2026-233266
AcademySoftwareFoundation.openexr is vulnerable to Out-of-bounds Write
63
Medium Risk
This Affects:
AcademySoftwareFoundation.openexrTL;DR
OpenEXR's InputFile::rawPixelDataToBuffer() and ScanLineInputFile::rawPixelDataToBuffer() compare a file chunk size against static_castuint64_t>(pixelDataSize). A negative caller-supplied pixelDataSize becomes a very large unsigned value, bypasses the too-small-buffer check, and lets a raw EXR chunk be copied into an undersized caller buffer. This requires the application to pass an unchecked signed size into the public raw-pixel API while reading an EXR. The fix rejects non-positive or otherwise invalid pixelDataSize values before copying.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you call rawPixelDataToBuffer() with an unchecked signed pixelDataSize while reading untrusted EXR files.
Background info
AcademySoftwareFoundation.openexr is vulnerable to Out-of-bounds Write in versions 2.0.0 - 3.4.13.
How to fix this
Upgrade the AcademySoftwareFoundation.openexr library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant