CVE-2026-27622

Affected versions of the OpenEXR package are vulnerable to an Out-of-bounds Write due to a 32-bit integer overflow when accumulating deep sample counts, leading to an undersized heap allocation. In CompositeDeepScanLine::readPixels, attacker-influenced values added into vector<unsigned int> total_sizes and then into overall_sample_count can wrap modulo 2^32, so samples[channel].resize(overall_sample_count) allocates too small a buffer while subsequent decoding writes the true (larger) sample volume via generic_unpack_deep_pointers in src/lib/OpenEXRCore/unpack.c.