OpenEXR EUVD-2026-65691

Exploitation requires all three of the following conditions simultaneously: (1) the target must be running an ILP32 (32-bit ABI) build of OpenEXR - any 64-bit deployment where size_t is 64-bit is completely unaffected because the arithmetic overflow cannot occur; (2) the application must process uncompressed deep-tile EXR files, as the vulnerable code path in update_pack_unpack_ptrs() and unpack_sample_table() is only reachable for this specific tile encoding; (3) user interaction is required - the victim must open or trigger processing of the attacker-supplied EXR file (CVSS UI:R). Authentication requirements are not a factor at the library level (CVSS PR:N), but the file must reach an ILP32 host where a user opens it. The conjunction of the 32-bit platform requirement and the deep-tile format specificity substantially narrows the realistic attack surface.

The CVSS 3.1 base score of 5.5 (Medium) is consistent with the narrow exploitation conditions: AV:L and UI:R together require a victim on an ILP32 system to open a crafted file, ruling out unauthenticated remote exploitation and automated scanning. The platform restriction to 32-bit ILP32 builds is the most significant limiting factor - modern production deployments on LP64 or LLP64 (x86-64, ARM64) are entirely unaffected because size_t is 64-bit and the overflow cannot occur. No EPSS data was supplied in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept exploit has been identified, consistent with a low real-world exploitation urgency. One notable discrepancy: the input tags include 'Information Disclosure,' which conflicts with the CVSS C:N rating; while OOB reads can theoretically expose adjacent heap contents, the described impact is denial of service only, and this inconsistency should be verified against the vendor advisory. Overall, this is a low-real-risk issue for the majority of deployments, but warrants prompt patching for any 32-bit embedded or legacy rendering pipeline consuming untrusted EXR content.

An attacker crafts a malicious EXR file containing an uncompressed deep-tile image whose tile width and height values are chosen to cause their 32-bit product to wrap to a small value when multiplied as size_t. When a user on an ILP32 system opens the file with any application linked against the vulnerable OpenEXR library - such as a compositing tool or image viewer - decoding.c allocates an undersized sample-count table, and unpack_sample_table() reads past the buffer end, crashing the host process. No public proof-of-concept exploit has been identified at time of analysis.