OpenEXR versions 3.4.0 to 3.4.11 contain a heap-based buffer overflow read in the HTJ2K decoder's ht_undo_impl() function. The function copies decoded pixels using the EXR channel's declared width without validating that this width matches the actual buffer length from the OpenJPH line buffer. A crafted EXR file can exploit this mismatch to read 4 bytes beyond the allocated heap buffer, causing a crash and potential adjacent heap memory leak. This vulnerability is reachable through the standard scanline-decode interface used by all consumers of exr_decoding_run/Imf::checkOpenEXRFile, thus affecting a wide range of applications processing untrusted EXR files. The issue is addressed in OpenEXR version 3.4.12.

Exploitation of this vulnerability can cause deterministic application crashes (denial of service) and may lead to leakage of adjacent heap memory. This affects any software that decodes untrusted EXR files using the vulnerable OpenEXR versions. There is no indication of code execution or privilege escalation from the provided data.

A fix is available in OpenEXR version 3.4.12. Users and organizations should upgrade to version 3.4.12 or later to remediate this vulnerability. Until upgraded, avoid processing untrusted EXR files with affected versions to mitigate risk.