A heap-buffer-overflow vulnerability exists in the generic_unpack function of OpenEXR versions 3.3.4 through 3.4.2 and related release candidates. The issue was identified by OSS-Fuzz and involves an out-of-bounds read during pixel data processing. A patch is available to address this flaw.