AIKIDO-2026-759752
AcademySoftwareFoundation.openexr is vulnerable to Denial of Service
55
Medium Risk
This Affects:
AcademySoftwareFoundation.openexrTL;DR
A signed integer overflow while decoding deep tile chunks from a crafted EXR can produce an out-of-bounds memory access and crash the reading process. The issue is reachable by opening a malformed deep tiled file and results in denial of service rather than reliably attacker-controlled corruption. The fix validates deep-tile size computations with wider arithmetic before indexing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you decode untrusted deep tiled EXR files.
Background info
AcademySoftwareFoundation.openexr is vulnerable to Denial of Service in versions 3.3.0 - 3.3.12 and 3.4.0 - 3.4.13.
How to fix this
Upgrade the AcademySoftwareFoundation.openexr library to the patch version.
Links
Fix Commits
github.com/AcademySoftwareFoundation/openexr/commit/5e55a64ad1f119a8166542f4b6e034c31b7e043agithub.com/AcademySoftwareFoundation/openexr/commit/a6cf183725b5665ac3fdbec640125fba5ee1ab39github.com/AcademySoftwareFoundation/openexr/commit/e2adb5be3bbc3a1f82f2bc06cc9699995a99a607
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.