An integer overflow vulnerability in OpenEXR allows remote attackers to execute arbitrary code via crafted image files requiring user interaction.

The flaw is an integer overflow in ImageChannel::resize (CWE-190) that leads to a heap out-of-bounds write via the OpenEXRUtil public API, requiring user interaction by an unauthenticated attacker.

A successful exploitation of this vulnerability can lead to total system compromise, allowing an attacker to execute arbitrary code, cause denial of service, or corrupt sensitive data. With a high CVSS score of 8.8, this flaw poses a severe risk to confidentiality, integrity, and availability, particularly for media and entertainment organizations relying on affected software for image processing pipelines.

Immediate Action: Update OpenEXR to version 3.2.9, 3.3.11, 3.4.11, or later, depending on the active branch.

Proactive Monitoring: Monitor systems processing untrusted EXR files for abnormal application crashes, memory consumption spikes, or unexpected process terminations.

Compensating Controls: Implement strict input validation and process EXR files within isolated sandbox environments or containers to limit the impact of potential memory corruption.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for total system compromise, organizations utilizing the OpenEXR library must prioritize applying the provided vendor patches immediately. Administrators should coordinate updates across all dependent software packages and development pipelines to eliminate the heap out-of-bounds write vector.