OpenEXR, a widely used reference implementation for the EXR image format, contains an integer overflow in the ht_undo_impl() function within src/lib/OpenEXRCore/internal_ht.cpp in versions 3.4.0 through 3.4.11. The vulnerability occurs when decode->channels[i].width (int32_t) is multiplied by bytes_per_element using 32-bit signed arithmetic, which can overflow for large widths (e.g., >= 536870912 for FLOAT data). This overflow leads to corrupted offsets used in pointer arithmetic, causing heap-buffer overflows during decoding of crafted HTJ2K-compressed EXR files. Similar unchecked multiplication patterns exist in other HTJ2K code paths. The issue is addressed in version 3.4.12.

The integer overflow leads to heap-buffer overflow conditions that can cause heap out-of-bounds writes during image decoding. This can result in denial of service or potential memory corruption. There is no indication of confidentiality impact, but integrity and availability impacts are possible as per the CVSS vector (Integrity Low, Availability High). No known exploits in the wild have been reported.

A fix is available in OpenEXR version 3.4.12. Users should upgrade to version 3.4.12 or later to remediate this vulnerability. No other mitigations are specified.