A heap out-of-bounds read vulnerability exists in OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12. The flaw is in the TypedDeepImageChannel<T>::row() API, which can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin. The root cause is a conflict between two coordinate models in ImfDeepImageChannel: at(x, y) uses absolute coordinates while row(r) is documented as 0-based logical access. For non-zero dataWindow.min values, row(0) points outside the _sampleListPointers allocation, causing a heap out-of-bounds read and potential crash. Under a controlled heap layout, this could lead to information disclosure. The vulnerability affects the EXR image format library widely used in the motion picture industry. Fixes are available in versions 3.3.13 and 3.4.13.
