Integer overflow in OpenEXR - CVE-2026-55373
Published: June 23, 2026
Vulnerability identifier: #VU135033
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55373
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow or wraparound in roundListSizeUp() in OpenEXRUtil SampleCountChannel when processing a sample count of UINT_MAX. A remote attacker can supply a UINT_MAX sample count through the public API to cause a denial of service.
The issue results in an infinite CPU loop in both the endEdit() path and the direct set(x, y, UINT_MAX) path.
Affected software
OpenEXR
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Desktop Applications Module
Fedora
libIlmImfUtil-2_2-23
libIlmImfUtil-2_2-23-debuginfo
libIlmImf-2_2-23
openexr-debugsource
openexr-devel
libIlmImf-2_2-23-debuginfo
openexr-debuginfo
mingw-openexr
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Desktop Applications Module
Fedora
libIlmImfUtil-2_2-23
libIlmImfUtil-2_2-23-debuginfo
libIlmImf-2_2-23
openexr-debugsource
openexr-devel
libIlmImf-2_2-23-debuginfo
openexr-debuginfo
mingw-openexr
How to mitigate CVE-2026-55373
Install security update from vendor's website.
OpenEXR - addressed in versions 3.2.10, 3.3.12, 3.4.13
libIlmImfUtil-2_2-23 - update to 2.2.1-150000.3.52.1
libIlmImfUtil-2_2-23-debuginfo - update to 2.2.1-150000.3.52.1
libIlmImf-2_2-23 - update to 2.2.1-150000.3.52.1
openexr-debugsource - update to 2.2.1-150000.3.52.1
openexr-devel - update to 2.2.1-150000.3.52.1
libIlmImf-2_2-23-debuginfo - update to 2.2.1-150000.3.52.1
openexr-debuginfo - update to 2.2.1-150000.3.52.1
mingw-openexr - addressed in versions 3.3.14-1.fc43, 3.4.15-1.fc44, 3.4.15-1.fc45
libIlmImfUtil-2_2-23 - update to 2.2.1-150000.3.52.1
libIlmImfUtil-2_2-23-debuginfo - update to 2.2.1-150000.3.52.1
libIlmImf-2_2-23 - update to 2.2.1-150000.3.52.1
openexr-debugsource - update to 2.2.1-150000.3.52.1
openexr-devel - update to 2.2.1-150000.3.52.1
libIlmImf-2_2-23-debuginfo - update to 2.2.1-150000.3.52.1
openexr-debuginfo - update to 2.2.1-150000.3.52.1
mingw-openexr - addressed in versions 3.3.14-1.fc43, 3.4.15-1.fc44, 3.4.15-1.fc45