A heap-based buffer overflow vulnerability in the OpenImageIO library could lead to arbitrary code execution or system crashes when processing malicious OpenEXR image files.

The vulnerability exists in the OpenEXRInput::read_native_tiles function within src/openexr.imageio/exrinput.cpp. An attacker can trigger a heap out-of-bounds write by providing a tiled OpenEXR image with a width that is not a multiple of the tile width, causing the software to use an incorrect scanline stride during memory operations.

Successful exploitation of this vulnerability allows an attacker to corrupt memory and potentially achieve remote code execution, which could lead to a total compromise of the affected host system. Given the CVSS score of 7.8, this represents a high-severity risk to organizations that use this library in production VFX or animation pipelines. Compromise could result in unauthorized data access, loss of intellectual property, or significant operational downtime during incident response efforts.

Immediate Action: Update the OpenImageIO library to versions 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1, which contain the necessary fixes for the memory corruption flaw.

Proactive Monitoring: Monitor application logs for unexpected crashes or segmentation faults, particularly when processing untrusted or externally sourced OpenEXR image files.

Compensating Controls: Implement strict input validation or sandboxing for any services that automatically process image files from external sources to limit the impact of potential memory corruption.

Public Exploit Available: No

The severity of this vulnerability, combined with its potential for memory corruption, necessitates prompt action. Organizations should identify all internal tools and third-party software that utilize the OpenImageIO library and prioritize the deployment of the updated versions provided by the vendor. Failure to patch may expose systems to sophisticated attacks targeting the VFX and animation processing workflows.