Skip to content
OpenAdvisories
Medium · 6.2 CVE-2026-55373 EUVD-2026-65185

OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts

Published Aug 25, 2026 · Updated Aug 25, 2026 · Assigned by GitHub_M

Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an infinite-loop vulnerability in SampleCountChannel. The helper roundListSizeUp() rounds a sample-list size up to the next power of two using repeated unsigned left shifts, which terminates for normal values but fails for UINT_MAX: the sequence reaches 0x80000000, and the next left shift wraps the 32-bit value to 0. Because 0 remains less than UINT_MAX, the loop never progresses and never exits. The bug is reachable through public OpenEXRUtil APIs, either by editing the sample-count buffer through SampleCountChannel::Edit (whose destructor calls endEdit()) or by calling SampleCountChannel::set(x, y, UINT_MAX) on a valid pixel. This issue has been fixed in versions 3.2.10, 3.3.12, and 3.4.13.

Affected products

VendorProductAffectedFixed
AcademySoftwareFoundation openexr < 3.2.10, >= 3.3.0, < 3.3.12, >= 3.4.0, < 3.4.13 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 openexr 3.4.14-0.1 —
Debian 13 openexr 3.2.12-1~deb13u1 —
Debian 12 openexr No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 openexr No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS openexr No fix yet —
Ubuntu Pro 24.04 LTS openexr No fix yet —
Ubuntu Pro 22.04 LTS openexr No fix yet —
Ubuntu Pro 20.04 LTS openexr No fix yet —
Ubuntu Pro 18.04 LTS openexr No fix yet —
Ubuntu Pro 16.04 LTS openexr No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 openexr 2.2.1-150000.3.52.1 SUSE-SU-2026:3169-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 openexr 3.2.2-160000.9.1 SUSE-SU-2026:22653-1
SLES 16.0 openexr 3.2.2-160000.9.1 SUSE-SU-2026:22653-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed openexr 3.4.13-1.1 openSUSE-SU-2026:11218-1
openSUSE Leap 16.0 openexr 3.2.2-160000.9.1 openSUSE-SU-2026:21336-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 openexr +2 3.1.5-1.amzn2023.0.12 ALAS2023-2026-2154

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 OpenEXR No fix yet —

Advisories 5

References