OpenEXR EUVD-2026-28251

Requires victim user interaction to open or process an attacker-supplied EXR file using an application that links against vulnerable OpenEXR versions (3.0.x-3.2.8, 3.3.0-3.3.10, 3.4.0-3.4.10) and invokes OpenEXRUtil's ImageChannel::resize via the public API. The vulnerability triggers when processing image channel metadata with dimensions that cause integer overflow during multiplication - specifically when width * height exceeds size_t maximum value on the target architecture (2^32-1 on 32-bit systems, practically exploitable on 64-bit with extreme values). No authentication required (PR:N) as this is a file format parser vulnerability, not a network service. Exploitation is LIMITED by the requirement that malicious file must reach and be processed by vulnerable OpenEXR library - not exploitable against systems that validate file sources, sandbox file processing, or use statically linked applications with patched library versions. The network attack vector (AV:N) reflects remote file delivery capability (email attachment, web download, cloud storage), not direct network exploitation.

CVSS 8.8 accurately reflects high potential impact (code execution, data corruption, DoS) but the mandatory user interaction (UI:R) substantially reduces real-world weaponization. EPSS data not provided, but absence from CISA KEV and no public POC (despite GitHub patch visibility since PR #2367) suggest low active exploitation. The attack requires social engineering to convince a user to open a maliciously crafted EXR file in an application using OpenEXRUtil APIs. OpenEXR is widely deployed in professional creative software (Adobe, Nuke, Blender), making the installed base large but the target audience (VFX professionals) typically file-source-aware. The vulnerability is NOT remotely exploitable without user action - network vector (AV:N) reflects file delivery via web/email, not autonomous network service exploitation. Priority depends on deployment context: HIGH for automated server-side EXR processing pipelines (render farms, cloud transcoding), MEDIUM for artist workstations with defense-in-depth controls, LOWER for airgapped production environments. The integer overflow primitive is well-understood and reliably exploitable once triggered, but low attack complexity (AC:L) assumes attacker can craft dimension values that overflow on the target architecture. Organizations should prioritize patching server-side processing infrastructure first, then artist workstations, validating that upgraded library versions propagate to all dependent applications.

An attacker crafts a malicious EXR file with image channel dimensions set to values that trigger integer overflow when multiplied (e.g., width=0x10001, height=0x10000 on 32-bit size_t systems, resulting in 0x100010000 wrapping to 0x10000). The victim opens this file in an application using OpenEXRUtil (video editing software, image viewer, automated rendering pipeline). OpenEXR's ImageChannel::resize calculates an undersized heap buffer based on the wrapped value, then writes full-resolution image data into it, overflowing adjacent heap structures. Attacker gains code execution by corrupting heap metadata or function pointers, or achieves denial of service via crash. Publicly available exploit code not identified, but the patch diff provides a complete exploitation roadmap for skilled attackers.