Qiaozhiyi

**Name of the Vulnerable Software and Affected Versions** openexr (affected versions not specified) **Description** An unchecked integer overflow occurs in the `Image::resize()` function. When followed by an exception, this can lead to an invalid delete operation via uninitialized pointers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenEXR versions 3.4.0 through 3.4.12 **Description** OpenEXR contains a NULL pointer dereference in the OpenEXRCore function `exr attr set bytes()`. The issue occurs because the public setter validates the top-level `exr attr bytes t` value pointer but fails to verify that the nested `type hint` pointer is non-NULL when `hint length` is greater than zero. If a caller provides a positive `hint length` with a NULL `type hint`, the `exr attr bytes create()` function allocates a destination buffer and attempts to copy data from the NULL source pointer, leading to a deterministic crash and a denial of service. This flaw is reachable via the public OpenEXRCore C API. **Recommendations** Update OpenEXR to version 3.4.13.

**Name of the Vulnerable Software and Affected Versions** OpenEXR versions prior to 3.2.10 OpenEXR versions prior to 3.3.12 OpenEXR versions prior to 3.4.13 **Description** An infinite-loop issue exists in `SampleCountChannel` due to the `roundListSizeUp()` function. This function rounds a sample-list size to the next power of two using repeated unsigned left shifts. When the value `UINT MAX` is processed, the sequence reaches 0x80000000, and the subsequent left shift wraps the 32-bit value to 0. Since 0 remains less than `UINT MAX`, the loop never terminates. This can be triggered via public OpenEXRUtil APIs by calling `SampleCountChannel::set(x, y, UINT MAX)` on a valid pixel or by editing the sample-count buffer through `SampleCountChannel::Edit` (where the destructor calls `endEdit()`). **Recommendations** Update OpenEXR to version 3.2.10. Update OpenEXR to version 3.3.12. Update OpenEXR to version 3.4.13.