AIKIDO-2026-847130
AcademySoftwareFoundation.openexr is vulnerable to Out-of-bounds Write
55
Medium Risk
This Affects:
AcademySoftwareFoundation.openexrTL;DR
The exrmultiview tool builds a subsampled channel union into a destination buffer without correctly accounting for subsampled layout, allowing a crafted EXR to write past the heap allocation. Running exrmultiview on such a file can crash the tool or corrupt memory. The fix corrects subsampled union buffer sizing and writes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the exrmultiview tool on untrusted EXR files with subsampled channels.
Background info
AcademySoftwareFoundation.openexr is vulnerable to Out-of-bounds Write in versions 2.0.0 - 3.4.13.
How to fix this
Upgrade the AcademySoftwareFoundation.openexr library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant