The openexr library, used for handling EXR image files in the motion picture industry, contains an integer overflow vulnerability (CWE-190) in the ImageChannel::resize function. This overflow can cause a heap out-of-bounds write when accessed through the OpenEXRUtil public API. Affected versions include 3.0.0 up to but not including 3.2.9, 3.3.0 up to but not including 3.3.11, and 3.4.0 up to but not including 3.4.11. The issue is patched in versions 3.2.9, 3.3.11, and 3.4.11. The vulnerability has a CVSS v3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to cause a heap out-of-bounds write, potentially leading to arbitrary code execution, data corruption, or denial of service. The high CVSS score (8.8) reflects significant impact on confidentiality, integrity, and availability of affected systems. However, there are no known exploits in the wild currently.

This vulnerability has been patched in openexr versions 3.2.9, 3.3.11, and 3.4.11. Users and organizations should upgrade to one of these fixed versions to remediate the issue. Since the vendor advisory or patch links are not explicitly provided, confirm patch availability and upgrade instructions from the official AcademySoftwareFoundation openexr project resources before applying updates. No additional mitigations are indicated.