Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an infinite-loop vulnerability in SampleCountChannel. The helper roundListSizeUp() rounds a sample-list size up to the next power of two using repeated unsigned left shifts, which terminates for normal values but fails for UINT_MAX: the sequence reaches 0x80000000, and the next left shift wraps the 32-bit value to 0. Because 0 remains less than UINT_MAX, the loop never progresses and never exits. The bug is reachable through public OpenEXRUtil APIs, either by editing the sample-count buffer through SampleCountChannel::Edit (whose destructor calls endEdit()) or by calling SampleCountChannel::set(x, y, UINT_MAX) on a valid pixel. This issue has been fixed in versions 3.2.10, 3.3.12, and 3.4.13.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AcademySoftwareFoundation | openexr | < 3.2.10, >= 3.3.0, < 3.3.12, >= 3.4.0, < 3.4.13 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openexr | 3.4.14-0.1 | — |
| Debian 13 | openexr | 3.2.12-1~deb13u1 | — |
| Debian 12 | openexr | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | openexr | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | openexr | No fix yet | — |
| Ubuntu Pro 24.04 LTS | openexr | No fix yet | — |
| Ubuntu Pro 22.04 LTS | openexr | No fix yet | — |
| Ubuntu Pro 20.04 LTS | openexr | No fix yet | — |
| Ubuntu Pro 18.04 LTS | openexr | No fix yet | — |
| Ubuntu Pro 16.04 LTS | openexr | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | openexr | 2.2.1-150000.3.52.1 | SUSE-SU-2026:3169-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | openexr | 3.2.2-160000.9.1 | SUSE-SU-2026:22653-1 |
| SLES 16.0 | openexr | 3.2.2-160000.9.1 | SUSE-SU-2026:22653-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openexr | 3.4.13-1.1 | openSUSE-SU-2026:11218-1 |
| openSUSE Leap 16.0 | openexr | 3.2.2-160000.9.1 | openSUSE-SU-2026:21336-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | openexr +2 | 3.1.5-1.amzn2023.0.12 | ALAS2023-2026-2154 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | OpenEXR | No fix yet | — |
Advisories 5
- ALAS2023-2026-2154 Important: openexr security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 14, 2026
- SUSE-SU-2026:3169-1 Security update for openexr SUSE / openSUSE Security Updates · Jul 22, 2026
- SUSE-SU-2026:22653-1 Security update for openexr SUSE / openSUSE Security Updates · Jul 17, 2026
- openSUSE-SU-2026:21336-1 Security update for openexr SUSE / openSUSE Security Updates · Jul 15, 2026
- openSUSE-SU-2026:11218-1 libIex-3_4-33-3.4.13-1.1 on GA media SUSE / openSUSE Security Updates · Jul 9, 2026