SB2026072261 - SUSE update for openexr
Published: July 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2026-54920)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in OpenEXRUtil Image::resize() and Image::clearLevels() when processing crafted Imath::Box2i data window coordinates through the public API. A remote attacker can supply crafted coordinate values that trigger exception cleanup and invalid deletion of uninitialized ImageLevel pointers to cause a denial of service.
The issue is confirmed to crash the process through an invalid delete of uninitialized pointer entries during exception cleanup, while remote code execution was not confirmed.
2) Out-of-bounds write (CVE-ID: CVE-2026-55059)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in Imf_4_0::SampleCountChannel::set(int r, unsigned int newNumSamples[]) when processing row-based sample-count updates through the OpenEXRUtil DeepImage API. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.
User interaction is required, and exploitation requires image data windows whose X and Y origins differ.
3) Integer overflow (CVE-ID: CVE-2026-55373)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow or wraparound in roundListSizeUp() in OpenEXRUtil SampleCountChannel when processing a sample count of UINT_MAX. A remote attacker can supply a UINT_MAX sample count through the public API to cause a denial of service.
The issue results in an infinite CPU loop in both the endEdit() path and the direct set(x, y, UINT_MAX) path.
Remediation
Install update from vendor's website.