AIKIDO-2026-839707

TL;DR

OpenEXR's IDManifest decompression reads the compressed attribute's declared uncompressed size directly from the file and allocates a buffer of that size before validating it against the compressed size on disk. A crafted file with a large declared size forces the OS to commit an enormous amount of real memory until the process is killed, while a zero or near zero declared size leaves the decompression output buffer null and triggers a null pointer dereference or a small out-of-bounds heap read when the library reads past it. Both faults are deterministic and reachable from parsing a file only a few hundred bytes in size. The fix bounds the declared size against the compressed size using zlib's maximum expansion ratio and validates the buffer length before reading the manifest version field.