CVE-2025-59731

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 8.0

Description The software is susceptible to an issue when decoding OpenEXR files that utilize DWAA or DWAB compression. Specifically, the length of run-length-encoded data is not validated during the decoding process. This can lead to out-of-bounds access when reading data from the td->rle raw data buffer, potentially resulting in a crash or other unexpected behavior. The issue occurs because the code reads rle raw size from the input file and uses it to determine the size of the buffer, but does not verify that subsequent access to the buffer remains within the allocated bounds. The access at [2] may exceed rle raw size.

Recommendations Upgrade to version 8.0 or beyond.