CVE-2026-55059
Received Received - Intake

Heap Out-of-Bounds Write in OpenEXR Image Library

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap out-of-bounds write in Imf_4_0::SampleCountChannel::set(int r, unsigned int newNumSamples[]). The row-based sample-count setter computes the target Y coordinate with dataWindow.min.x instead of dataWindow.min.y. For a valid deep image data window where min.x != min.y, a valid row index can be translated into an invalid Y coordinate, causing writes before the allocated _numSamples buffer. The vulnerability is reachable through the public OpenEXRUtil DeepImage API and can lead to heap corruption and process crashes. This issue has been fixed in versions 3.2.10, 3.3.12 and 3.4.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55059
EUVD
EUVD-2026-65183

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
academysoftwarefoundation openexr 2.*
academysoftwarefoundation openexr 3.0.*
academysoftwarefoundation openexr 3.1.*
academysoftwarefoundation openexr From 3.2.0 (inc) to 3.2.10 (exc)
academysoftwarefoundation openexr From 3.3.0 (inc) to 3.3.12 (exc)
academysoftwarefoundation openexr From 3.4.0 (inc) to 3.4.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds write in OpenEXR's SampleCountChannel::set function. It occurs because the code incorrectly calculates the Y coordinate using dataWindow.min.x instead of dataWindow.min.y. When the data window's X and Y origins differ, a valid row index can become an invalid Y coordinate, causing writes outside the allocated buffer. This leads to heap corruption and potential process crashes.

Detection Guidance

To detect this vulnerability, check the installed OpenEXR version using commands like 'exrheader --version' or 'dpkg -l | grep openexr' on Linux. Compare the version against affected ranges (2.*, 3.0.*, 3.1.*, 3.2.0-3.2.9, 3.3.0-3.3.11, 3.4.0-3.4.12). If using a vulnerable version, update to 3.2.10, 3.3.12, or 3.4.13.

Impact Analysis

This vulnerability can cause heap corruption and process crashes, leading to denial of service. If exploited, it may allow attackers to corrupt memory, though direct exploitation via crafted EXR files has not been confirmed. Systems processing EXR files with affected OpenEXR versions are at risk.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing data corruption or denial of service in systems processing EXR image files. If exploited, it may lead to unauthorized data access or processing disruptions, which could violate integrity or availability requirements in these regulations.

Mitigation Strategies

Immediately update OpenEXR to patched versions (3.2.10, 3.3.12, or 3.4.13) using your package manager (e.g., 'apt upgrade openexr' or 'yum update openexr'). If updating is not possible, restrict access to applications using OpenEXRUtil DeepImage API until patched versions are deployed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart