AIKIDO-2026-26571

TL;DR

OpenEXRCore reconstructs DWAA/DWAB channels classified as UNKNOWN from an inflated scratch buffer. The decoder only checks that the declared UNKNOWN stream fits the scratch buffer, not that it supplies enough bytes for every UNKNOWN channel, so a file declaring a short UNKNOWN stream leaves part of the buffer uninitialized. The row-copy path then reconstructs full channel rows from that buffer and returns bytes that were never written, disclosing stale heap memory. The fix requires the declared UNKNOWN size to cover the bytes needed by UNKNOWN-classified channels.