OpenEXR, a widely used image format implementation, contains a heap-buffer-overflow read vulnerability in the HTJ2K decoder's ht_undo_impl() function in versions 3.4.0 through 3.4.11. The function copies decoded pixels based on the EXR channel's declared width without validating that this width matches the actual buffer size from the embedded codestream. A crafted EXR file can exploit this mismatch to cause a 4-byte heap-buffer-overflow read immediately after a buffer allocated by the codestream's finalize_alloc() method. This vulnerability is reachable through standard scanline decode entry points used by all consumers of exr_decoding_run and related utilities. The flaw can cause deterministic crashes and potential adjacent heap memory leaks. The issue is addressed in version 3.4.12.

The vulnerability allows an attacker to cause a deterministic crash (denial of service) and potentially leak adjacent heap memory by supplying a specially crafted EXR file to any application using the vulnerable OpenEXR versions. This affects thumbnailers, asset pipelines, and utilities that decode EXR files. There is no indication of remote code execution or privilege escalation from the provided data.

A fix is available in OpenEXR version 3.4.12. Users and organizations should upgrade to version 3.4.12 or later to remediate this vulnerability. There is no vendor advisory indication of alternative mitigations or that no action is required. Patch status is confirmed by the CVE description stating the issue is fixed in 3.4.12.