CVE-2026-55059: OpenEXR Buffer Overflow Vulnerability

CVE-2026-55059 Overview

OpenEXR is the reference implementation and specification for the EXR image format used across the motion picture industry. CVE-2026-55059 is a heap out-of-bounds write [CWE-787] in Imf_4_0::SampleCountChannel::set(int r, unsigned int newNumSamples[]). The row-based sample-count setter computes the target Y coordinate using dataWindow.min.x instead of dataWindow.min.y. When a deep image has a data window where min.x != min.y, a valid row index translates into an invalid Y coordinate, producing writes before the allocated _numSamples buffer. The flaw is reachable through the public OpenEXRUtil DeepImage API. Maintainers fixed the issue in versions 3.2.10, 3.3.12, and 3.4.13.

Critical Impact
Processing a crafted deep EXR image triggers heap corruption in the OpenEXRUtil DeepImage API, leading to process crashes and potential memory integrity loss.

Affected Products

OpenEXR versions prior to 3.2.10 on the 3.2.x branch
OpenEXR versions prior to 3.3.12 on the 3.3.x branch
OpenEXR versions prior to 3.4.13 on the 3.4.x branch

Discovery Timeline

2026-08-25 - CVE-2026-55059 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-55059

Vulnerability Analysis

The defect lives in the deep image sample-count logic within the Imf_4_0::SampleCountChannel::set method. Deep EXR images store variable-length sample data per pixel, indexed against a data window that defines pixel coordinate ranges. The row setter is expected to translate a caller-supplied row index r into an internal Y offset using the vertical minimum of the data window. Instead, the implementation subtracts dataWindow.min.x, the horizontal minimum. When a deep image declares a data window with unequal horizontal and vertical minimums, the arithmetic drifts and produces a Y coordinate that falls outside the buffer allocated for _numSamples. Writes then land in memory preceding the target allocation, corrupting adjacent heap structures. Because the API is public through OpenEXRUtil, downstream applications that ingest untrusted EXR content inherit the issue without modification.

Root Cause

The root cause is a coordinate axis mix-up. The row-based setter should localize into the sample-count grid using dataWindow.min.y, since r represents a vertical row. Using dataWindow.min.x instead produces an index skew equal to min.y - min.x, which can be negative or exceed buffer bounds when the two minimums differ.

Attack Vector

An attacker delivers a malformed deep EXR file to an application that links against a vulnerable OpenEXR build and invokes the OpenEXRUtil DeepImage API. Local user interaction is required to open or process the file. Successful triggering causes heap corruption and process termination. The vulnerability does not require authentication or elevated privileges on the target system.

No verified public proof-of-concept code is available. Refer to the OpenEXR GHSA-54cp-3rq6-7mq8 advisory for authoritative technical details.

Detection Methods for CVE-2026-55059

Indicators of Compromise

Unexpected crashes in processes that load or convert deep EXR images through OpenEXR or OpenEXRUtil.
Heap corruption signatures reported by AddressSanitizer or Application Verifier when parsing deep EXR files.
Deep EXR assets whose header data window declares unequal min.x and min.y values arriving from untrusted sources.

Detection Strategies

Inventory build artifacts and container images for OpenEXR shared libraries below 3.2.10, 3.3.12, or 3.4.13.
Instrument media ingestion pipelines with sanitizer-enabled test builds to surface out-of-bounds writes during deep image parsing.
Correlate application crash telemetry with recent deep EXR file processing events in rendering, compositing, or asset-conversion workflows.

Monitoring Recommendations

Alert on repeated abnormal termination of rendering, compositing, or asset-processing services that consume EXR content.
Track file provenance for deep EXR assets entering production pipelines from external contributors or shared storage.
Monitor package managers and software bills of materials for dependency versions still pinned to unpatched OpenEXR releases.

How to Mitigate CVE-2026-55059

Immediate Actions Required

Upgrade OpenEXR to 3.2.10, 3.3.12, or 3.4.13 depending on the release branch in use.
Rebuild and redeploy any static binaries or container images that bundle OpenEXR to inherit the fix.
Audit third-party applications, DCC tools, and render farm software for embedded OpenEXR versions and request vendor updates.

Patch Information

The Academy Software Foundation resolved the coordinate mix-up in OpenEXR versions 3.2.10, 3.3.12, and 3.4.13. Full remediation guidance is published in the GitHub Security Advisory GHSA-54cp-3rq6-7mq8.

Workarounds

Restrict deep EXR ingestion to trusted internal sources until patched libraries are deployed across the pipeline.
Validate deep EXR headers and reject files whose data window declares unequal min.x and min.y values when patching is not yet feasible.
Isolate EXR conversion workloads in sandboxed processes so heap corruption cannot pivot into higher-value services.

bash

# Verify the installed OpenEXR version and confirm it meets the fixed release
pkg-config --modversion OpenEXR

# Example package upgrade paths
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade libopenexr-3-1-30 openexr

# Python bindings
pip install --upgrade 'OpenEXR>=3.4.13'