CVE-2026-55059— OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability
Quick assessment
Affected
AcademySoftwareFoundation openexr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenEXR 是 EXR 图像格式的参考实现和规范，广泛应用于影视行业。在版本 3.2.10、3.3.12 和 3.4.13 之前的版本中， 函数存在堆越界写入漏洞。该函数基于行样本计数的设置器在使用 而非正确的 来计算目标 Y 坐标。当图像数据窗口有效但满足 时，一个有效的行索引可能被错误地转换为非法的 Y 坐标，从而导致对已分配的 缓冲区之前的内存区域进行写入。该漏洞可通过公开的 OpenEXRUtil DeepImage API 触发，可能引发堆损坏和进程崩溃。此问题已在版本 3.2.10、3.3.12 和
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| AcademySoftwareFoundation | openexr | < 3.2.10 |
affected |
>= 3.3.0, < 3.3.12 |
affected | ||
>= 3.4.0, < 3.4.13 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55059
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap out-of-bounds write in Imf_4_0::SampleCountChannel::set(int r, unsigned int newNumSamples[]). The row-based sample-count setter computes the target Y coordinate with dataWindow.min.x instead of dataWindow.min.y. For a valid deep image data window where min.x != min.y, a valid row index can be translated into an invalid Y coordinate, causing writes before the allocated _numSamples buffer. The vulnerability is reachable through the public OpenEXRUtil DeepImage API and can lead to heap corruption and process crashes. This issue has been fixed in versions 3.2.10, 3.3.12 and 3.4.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AcademySoftwareFoundation | openexr | < 3.2.10 | - |
|
II. Public POCs for CVE-2026-55059
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55059
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-55059 (1)
Same Patch Batch · AcademySoftwareFoundation · 2026-08-25 · 20 CVEs total
| CVE-2026-59981 | 7.1 HIGH | OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow |
| CVE-2026-59184 | 7.1 HIGH | OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write |
| CVE-2026-59186 | 7.1 HIGH | OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (IL |
| CVE-2026-59187 | 7.1 HIGH | OpenEXR: exrmetrics deep pixelmode heap buffer overflow |
| CVE-2026-59189 | 7.1 HIGH | OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin |
| CVE-2026-59982 | 7.1 HIGH | OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms |
| CVE-2026-68515 | 7.1 HIGH | OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union |
| CVE-2026-68513 | 7.1 HIGH | OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collisio |
| CVE-2026-55371 | 6.9 MEDIUM | OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length |
| CVE-2026-65979 | 6.7 MEDIUM | OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN) |
| CVE-2026-55373 | 6.2 MEDIUM | OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample coun |
| CVE-2026-59984 | 5.5 MEDIUM | OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32 |
| CVE-2026-68514 | 5.5 MEDIUM | OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collisio |
| CVE-2026-61555 | 5.5 MEDIUM | OpenEXR: Empty multiView viewFromChannelName file crash |
| CVE-2026-59985 | 5.5 MEDIUM | OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32 |
| CVE-2026-59983 | 5.5 MEDIUM | OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32 |
| CVE-2026-59183 | 5.5 MEDIUM | OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decod |
| CVE-2026-62986 | 4.3 MEDIUM | OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure |
| CVE-2026-54920 | OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil im |
IV. Related Vulnerabilities
Same product: openexr
-
CVE-2026-59981
OpenEXR: Heap OOB read in SampleCountChannel row when using -
CVE-2026-68514
OpenEXR: Heap buffer overflow in PyOpenEXR from literal/pref -
CVE-2026-68515
OpenEXR: Heap out-of-bounds write in exrmultiview with subsa -
CVE-2026-68513
OpenEXR: Heap buffer overflow in PyOpenEXR from literal/pref -
CVE-2026-65979
OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidate
Same vendor: AcademySoftwareFoundation
-
CVE-2026-59981
OpenEXR: Heap OOB read in SampleCountChannel row when using -
CVE-2026-68514
OpenEXR: Heap buffer overflow in PyOpenEXR from literal/pref -
CVE-2026-68515
OpenEXR: Heap out-of-bounds write in exrmultiview with subsa -
CVE-2026-68513
OpenEXR: Heap buffer overflow in PyOpenEXR from literal/pref -
CVE-2026-65979
OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidate
V. Comments for CVE-2026-55059
No comments yet