A critical integer overflow vulnerability in the OpenEXR library, affecting versions 3.1.0 through 3.4.8, allows attackers to achieve unauthorized memory access and potential code execution via malicious files.

This vulnerability occurs in the internal_exr_undo_piz function, where an integer overflow in wavelet pointer arithmetic enables out-of-bounds memory read and write operations. The flaw can be triggered by an unauthenticated attacker providing a specially crafted EXR file.

The ability to perform out-of-bounds memory reads and writes poses a significant risk to data confidentiality, integrity, and system stability. Given the 7.8 CVSS score, this flaw could lead to application crashes or allow an attacker to execute arbitrary code within the context of the software processing the image, potentially leading to a full system compromise.

Immediate Action: Update OpenEXR to version 3.2.7, 3.3.9, 3.4.9, or higher, depending on your current deployment branch.

Proactive Monitoring: Implement robust input validation for all image processing pipelines and monitor for abnormal process crashes or memory access violations in applications utilizing the OpenEXR library.

Compensating Controls: Deploy endpoint protection solutions that can detect and block malicious file patterns or buffer overflow attempts when processing untrusted EXR files.

Public Exploit Available: No

Organizations should prioritize patching this vulnerability, especially in environments that process externally sourced or untrusted EXR image files. Updating to the latest stable release provided by the Academy Software Foundation is the only effective way to neutralize the risk of memory-related exploitation.