CVE-2026-55373: OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an infinite-loop vulnerability in SampleCountChannel. The helper roundListSizeUp() rounds a sample-list size up to the next power of two using repeated unsigned left shifts, which terminates for normal values but fails for UINTMAX: the sequence reaches 0x80000000, and the next left shift wraps the 32-bit value to 0. Because 0 remains less than UINTMAX, the loop never progresses and never exits. The bug is reachable through public OpenEXRUtil APIs, either by editing the sample-count buffer through SampleCountChannel::Edit (whose destructor calls endEdit()) or by calling SampleCountChannel::set(x, y, UINTMAX) on a valid pixel. This issue has been fixed in versions 3.2.10, 3.3.12, and 3.4.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.2.10 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.3.12 - Upgrade
Upgrade
OpenEXRto a version that resolves this vulnerability.Fixed in 3.4.13
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using OpenEXR versions before 3.2.10, 3.3.12, or 3.4.13 are affected if they use the public OpenEXRUtil SampleCountChannel APIs on valid pixels. The issue is triggered by a sample count of UINT_MAX.
What does an attacker or triggering input need to do?
The vulnerable path can be reached by calling SampleCountChannel::set(x, y, UINT_MAX) for a valid pixel, or by modifying the sample-count buffer through SampleCountChannel::Edit and allowing its destructor to invoke endEdit(). No privileges or user interaction are required according to the supplied severity vector.
What is the impact when the flaw is triggered?
The sample-list sizing loop does not terminate after the unsigned 32-bit value wraps to zero, causing the affected operation to loop indefinitely. The provided impact vector indicates availability impact without confidentiality or integrity impact.
What should be done if patching is not immediately possible?
Avoid passing UINT_MAX as a SampleCountChannel sample count and prevent untrusted or unchecked inputs from reaching SampleCountChannel::set or edits to the sample-count buffer with that value. Upgrade to 3.2.10, 3.3.12, or 3.4.13 when possible.