Executive brief
OpenEXR is a widely-used image format library for motion picture production and visual effects. A bug in the deep image API's sample-count setter incorrectly computes coordinates, allowing invalid memory writes that corrupt heap data and crash the application. Applications processing EXR files with certain data window configurations are vulnerable to denial of service.
Technical details
The vulnerability is a heap out-of-bounds write (CWE-787) in Imf_4_0::SampleCountChannel::set(int r, unsigned int newNumSamples[]) in OpenEXRUtil. The row-based setter incorrectly uses dataWindow.min.x instead of dataWindow.min.y when computing the target Y coordinate, causing writes to invalid memory locations when the data window's X and Y origins differ. The flaw is reachable through the public DeepImage API and affects versions prior to 3.2.10, 3.3.12, and 3.4.13. An attacker can trigger heap corruption and application crashes by providing a crafted deep image with a data window where min.x != min.y; user interaction (file handling) is required. The vulnerability has been patched in the mentioned versions.
Affected products
- Academy Software Foundation OpenEXR 2.x, 3.0.x, 3.1.x, 3.2.0-3.2.9, 3.3.0-3.3.11, 3.4.0-3.4.12
Timeline
- 2026-06-23: disclosed: GitHub security advisory GHSA-54cp-3rq6-7mq8 published
- 2026: patched: Fixed in versions 3.2.10, 3.3.12, and 3.4.13
- 2026-08-25: advisory: CVE-2026-55059 published on NVD