TinyEXR EUVD-2026-101225

Exploitation requires that the target application use the tinyexr library (≤3.2.0) to parse an attacker-supplied MULTI-PART EXR file - single-part EXR handling is not the affected path. The specific trigger is a later part-header whose stale remaining-size value causes ReadAttribute() bounds checks to be bypassed. Exploitation is LIMITED by: (1) required user interaction - a victim must open or process the crafted file (UI:P); (2) a local/file-based delivery vector (AV:L), not remote network service exposure; and (3) impact largely confined to application crash (DoS) with only limited leakage of adjacent heap memory, no code execution or integrity impact indicated. No authentication is required (PR:N), and default configurations of any tinyexr-consuming application that accepts multi-part EXR input are affected.

This is a moderate-severity memory-safety flaw (CVSS 4.0 base 6.9), not a top-tier priority. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) is internally consistent with the description: exploitation requires a victim to open a maliciously crafted multi-part EXR file (UI:P, AV:L), the primary impact is a crash/denial-of-service of the consuming application (VA:H) with only minor adjacent-heap information disclosure into attribute values (VC:L), and there is no integrity impact (VI:N). No EPSS score, KEV listing, POC flag, or SSVC decision was supplied in the input, so exploitation probability and automatability cannot be quantified from the data provided. The vulnerability is credible and well-documented (independent root-cause write-up plus source line references and a VulnCheck advisory), but because it is a file-parsing library bug requiring user interaction and yielding mainly DoS, it should be treated as a routine patch-when-available item rather than an emergency. Note: there is no conflict between signals here - the local/user-interaction vector and limited confidentiality impact both point to opportunistic, not mass, exploitation.

An attacker crafts a malicious multi-part OpenEXR file whose later part-headers carry a stale remaining-size value that bypasses ReadAttribute() bounds checks, then delivers it to a victim who opens it in any application linking tinyexr (≤3.2.0). When the file is parsed by ParseEXRMultipartHeaderFromMemory(), the library reads past the heap buffer, crashing the application or copying adjacent heap bytes into attribute values that may be exposed back to the attacker. A detailed public root-cause write-up exists, but no confirmed public exploit code was indicated in the provided data.