AIKIDO-2026-521249

TL;DR

OpenEXR's IDManifest parser reads a signed entry count directly from decompressed manifest data and resizes an internal vector to that count without checking it against the amount of data actually remaining or rejecting negative values. Each entry default-constructs a sizeable struct, so a crafted file only a few hundred bytes long can force the library to commit gigabytes of real memory before a single entry is read, crashing the process or triggering an out-of-memory kill. The allocation size comes purely from the declared count, independent of what the file actually contains. The fix rejects negative counts and grows the manifest one entry at a time instead of preallocating from the untrusted count.