The openexr library, used for the EXR image format, contains an integer overflow vulnerability in its DWA lossy decoder component. Specifically, the decoder uses signed 32-bit arithmetic to compute temporary per-component block pointers. For sufficiently large image widths, this calculation overflows, causing pointer wraparound. Subsequent decoder operations then access memory outside the allocated rowBlock buffer, leading to potential memory corruption. Affected versions include 3.2.0 up to but not including 3.2.7, 3.3.0 up to but not including 3.3.9, and 3.4.0 up to but not including 3.4.9. The vulnerability is resolved in versions 3.2.7, 3.3.9, and 3.4.9.

Exploitation of this vulnerability can result in out-of-bounds memory access due to pointer wraparound, which may lead to memory corruption. The CVSS 4.0 vector indicates local attack vector with low complexity and no privileges required, but user interaction is needed. The impact includes high confidentiality, integrity, and availability impacts, suggesting potential for significant security consequences such as data corruption or denial of service. There are no known exploits in the wild at this time.

A fix is available in openexr versions 3.2.7, 3.3.9, and 3.4.9. Users and organizations should upgrade to these versions to remediate the vulnerability. Since the vendor advisory confirms the fix in these versions, applying the official update is the recommended mitigation. Patch status is confirmed by the vendor advisory information.