Out-of-bounds write in OpenEXR - CVE-2026-55059

Vulnerability identifier: #VU135036

CSH Severity: Medium

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-55059

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in Imf_4_0::SampleCountChannel::set(int r, unsigned int newNumSamples[]) when processing row-based sample-count updates through the OpenEXRUtil DeepImage API. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required, and exploitation requires image data windows whose X and Y origins differ.

OpenEXR
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Desktop Applications Module
Fedora
libIlmImfUtil-2_2-23
libIlmImfUtil-2_2-23-debuginfo
libIlmImf-2_2-23
openexr-debugsource
openexr-devel
libIlmImf-2_2-23-debuginfo
openexr-debuginfo
mingw-openexr

Install security update from vendor's website.

OpenEXR - addressed in versions 3.2.10, 3.3.12, 3.4.13
libIlmImfUtil-2_2-23 - update to 2.2.1-150000.3.52.1
libIlmImfUtil-2_2-23-debuginfo - update to 2.2.1-150000.3.52.1
libIlmImf-2_2-23 - update to 2.2.1-150000.3.52.1
openexr-debugsource - update to 2.2.1-150000.3.52.1
openexr-devel - update to 2.2.1-150000.3.52.1
libIlmImf-2_2-23-debuginfo - update to 2.2.1-150000.3.52.1
openexr-debuginfo - update to 2.2.1-150000.3.52.1
mingw-openexr - addressed in versions 3.3.14-1.fc43, 3.4.15-1.fc44, 3.4.15-1.fc45

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-54cp-3rq6-7mq8

• Multiple vulnerabilities in OpenEXR
• SUSE update for openexr
• Fedora 43 update for mingw-openexr
• Fedora 45 update for mingw-openexr
• Fedora 44 update for mingw-openexr