Openexr EUVD-2026-19303

CVSS 6.5 with attack vector network, low complexity, and no privileges required indicates a moderately accessible vulnerability, though the required user interaction (UI:R-user must open the malicious file) significantly reduces real-world exploitability compared to automated network attacks. EPSS data not provided, but the signal constellation suggests moderate real-world risk: the attack surface is broad (any application processing untrusted EXR files), but impact is limited to denial-of-service (availability) with no confidentiality or integrity compromise. No KEV status or POC availability reported in input data, meaning exploitation has not been confirmed as active and no public exploit code has been published. The vulnerability is not a memory corruption or remote code execution issue-it is a crash condition triggered only when processing a crafted file. For applications accepting EXR files from untrusted sources (e.g., web upload services, collaborative design tools), this represents a moderate availability risk. For internal workflows processing EXR files from trusted sources, the risk is minimal. The unsigned nature of the crash (process termination via SIGILL) means no escalation pathway exists beyond denial-of-service.

An attacker crafts a malicious EXR image file with a negative dataWindow.min.x value set to a large integer (e.g., INT_MIN or similar), then distributes it via email, file-sharing service, or uploads it to a vulnerable web application that processes user-supplied images. When a user or automated system opens the file with a vulnerable version of OpenEXR or an application linked against it, the parser triggers integer overflow during width calculation, causing the process to crash with SIGILL and denying further service. No complex exploitation is required-a single file open is sufficient.