The vulnerability in AcademySoftwareFoundation's OpenEXR affects versions from 3.1.0 up to but not including 3.2.7, 3.3.9, and 3.4.9. The internal_exr_undo_piz() function uses signed 32-bit arithmetic for advancing the wavelet pointer, while nx, ny, and wcount are integers. A crafted EXR file can cause integer overflow and pointer wraparound, leading to out-of-bounds reads and writes during in-place wavelet decoding. This can result in arbitrary code execution and information disclosure. The issue is addressed by fixes in versions 3.2.7, 3.3.9, and 3.4.9. Red Hat has issued security advisories and updates for affected distributions including Red Hat Enterprise Linux 10.0 Extended Update Support.

Successful exploitation of this vulnerability can lead to arbitrary code execution and information disclosure due to out-of-bounds memory access during EXR file processing. The CVSS 4.0 vector indicates local attack vector with low complexity and no privileges or user interaction required, with high impact on confidentiality, integrity, and availability.

Fixes are available in OpenEXR versions 3.2.7, 3.3.9, and 3.4.9. Users and administrators should upgrade to these or later versions to remediate the vulnerability. Red Hat has released updated packages for affected Red Hat Enterprise Linux 10.0 Extended Update Support variants. Applying these vendor-provided updates is the recommended mitigation. Patch status is confirmed by vendor advisories.