CVE-2026-55373
Received Received - Intake

Infinite Loop in OpenEXR SampleCountChannel

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an infinite-loop vulnerability in SampleCountChannel. The helper roundListSizeUp() rounds a sample-list size up to the next power of two using repeated unsigned left shifts, which terminates for normal values but fails for UINT_MAX: the sequence reaches 0x80000000, and the next left shift wraps the 32-bit value to 0. Because 0 remains less than UINT_MAX, the loop never progresses and never exits. The bug is reachable through public OpenEXRUtil APIs, either by editing the sample-count buffer through SampleCountChannel::Edit (whose destructor calls endEdit()) or by calling SampleCountChannel::set(x, y, UINT_MAX) on a valid pixel. This issue has been fixed in versions 3.2.10, 3.3.12, and 3.4.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55373
EUVD
EUVD-2026-65185

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
academysoftwarefoundation openexr 2.*
academysoftwarefoundation openexr 3.0.*
academysoftwarefoundation openexr 3.1.*
academysoftwarefoundation openexr to 3.2.10 (exc)
academysoftwarefoundation openexr to 3.3.12 (exc)
academysoftwarefoundation openexr to 3.4.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an infinite-loop issue in OpenEXR's SampleCountChannel component. It occurs when handling UINT_MAX sample counts in the roundListSizeUp() function, which uses repeated unsigned left shifts to round sample-list sizes. For UINT_MAX (4294967295), the loop variable wraps from 0x80000000 to 0, causing the loop to never exit. This leads to a CPU denial-of-service condition.

Detection Guidance

To detect this vulnerability, check the installed OpenEXR version using commands like 'exrheader --version' or 'dpkg -l | grep openexr' on Linux. If the version is below 3.2.10, 3.3.12, or 3.4.13, the system is vulnerable. Test for the infinite loop by attempting to process a UINT_MAX sample count with OpenEXRUtil APIs.

Impact Analysis

The vulnerability can cause a denial-of-service by consuming excessive CPU resources indefinitely. It may hang applications processing OpenEXR files with UINT_MAX sample counts, disrupting normal operations. No memory corruption or data breaches are associated with this issue.

Compliance Impact

This vulnerability causes an infinite loop leading to CPU denial-of-service, which may disrupt system availability. While it does not directly affect data confidentiality or integrity, prolonged downtime could impact compliance with availability requirements in standards like GDPR (Article 32) and HIPAA (Security Rule). Organizations using vulnerable OpenEXR versions may face compliance risks if systems become unavailable.

Mitigation Strategies

Immediately upgrade OpenEXR to a patched version (3.2.10, 3.3.12, or 3.4.13) or higher. If upgrading is not possible, restrict access to OpenEXRUtil APIs and avoid processing untrusted EXR files. Monitor system CPU usage for unexpected spikes indicating exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart