Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55373— OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts

Quick assessment

Affected
AcademySoftwareFoundation openexr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenEXR 是 EXR 图像格式的参考实现和规范，在电影工业中被广泛使用。在 3.2.10、3.3.12 和 3.4.13 之前的版本中，SampleCountChannel 存在一个无限循环漏洞。辅助函数 roundListSizeUp() 通过重复的无符号左移操作将样本列表大小向上舍入到下一个 2 的幂。该操作对于正常值能够正常终止，但对于 UINT_MAX 则失败：移位序列会到达 0x80000000，下一次左移会使 32 位值回绕到 0。由于 0 始终小于 UINT_MAX，因此循环无法推进也无法退出。

CVSS 6.2 · Medium

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55373

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts
Source: CVE Program / CVE List V5
Vulnerability Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an infinite-loop vulnerability in SampleCountChannel. The helper roundListSizeUp() rounds a sample-list size up to the next power of two using repeated unsigned left shifts, which terminates for normal values but fails for UINT_MAX: the sequence reaches 0x80000000, and the next left shift wraps the 32-bit value to 0. Because 0 remains less than UINT_MAX, the loop never progresses and never exits. The bug is reachable through public OpenEXRUtil APIs, either by editing the sample-count buffer through SampleCountChannel::Edit (whose destructor calls endEdit()) or by calling SampleCountChannel::set(x, y, UINT_MAX) on a valid pixel. This issue has been fixed in versions 3.2.10, 3.3.12, and 3.4.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
AcademySoftwareFoundation openexr < 3.2.10 -

II. Public POCs for CVE-2026-55373

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55373

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-55373 (1)

Same Patch Batch · AcademySoftwareFoundation · 2026-08-25 · 5 CVEs total

CVE-2026-55371 6.9 MEDIUM OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length
CVE-2026-55059 6.1 MEDIUM OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnera
CVE-2026-59183 5.5 MEDIUM OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decod
CVE-2026-54920 OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil im

IV. Related Vulnerabilities

Same product: openexr
Same vendor: AcademySoftwareFoundation
Same weakness: CWE-190

V. Comments for CVE-2026-55373

No comments yet

Leave a comment