Executive brief
OpenEXR is a widely-used image format standard for motion picture production. A defect in the SampleCountChannel utility can cause the application to hang indefinitely when processing specially-crafted data, resulting in a denial of service and operational disruption.
Technical details
The vulnerability is an infinite loop in the roundListSizeUp() helper function in OpenEXRUtil's SampleCountChannel component. The function uses repeated unsigned left-shifts to round a sample-list size to the next power of two, but fails to handle the edge case where the input is UINT_MAX (4294967295). When n equals UINT_MAX, the shift sequence reaches 0x80000000; the next left shift wraps to 0, and since 0 is still less than UINT_MAX, the loop condition remains true forever. The vulnerability is reachable through two public APIs: SampleCountChannel::Edit (whose destructor calls endEdit()) and SampleCountChannel::set(x, y, UINT_MAX). An attacker or malicious application with control over sample-count values can trigger indefinite CPU consumption, causing a denial of service. Patches are available in versions 3.2.10, 3.3.12, and 3.4.13.
Affected products
- Academy Software Foundation OpenEXR 2.x, 3.0.x, 3.1.x, 3.2.0–3.2.9, 3.3.0–3.3.11, 3.4.0–3.4.12
Timeline
- 2026-06-23: disclosed
- 2026-08-25: patched: Versions 3.2.10, 3.3.12, and 3.4.13 released