CVE-2026-55059 AcademySoftwareFoundation CVE debrief

Who should care

Defenders responsible for systems utilizing the OpenEXR library, particularly in the motion picture industry, should assess exposure and prioritize verification and upgrades. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and upgrade to fixed versions of OpenEXR to prevent potential heap corruption and process crashes.

Why it matters

Defenders should prioritize verifying and upgrading to fixed versions of OpenEXR due to a heap out-of-bounds write vulnerability, which can lead to heap corruption and process crashes in systems utilizing the OpenEXR library.

• Potential heap corruption and process crashes
• Verification of OpenEXR version and exposure in systems utilizing the library
• Upgrades to fixed versions may be necessary to prevent exploitation

Technical summary

The vulnerability exists in the Imf_4_0::SampleCountChannel::set function, where a valid row index can be translated into an invalid Y coordinate, causing writes before the allocated _numSamples buffer. This issue is reachable through the public OpenEXRUtil DeepImage API and can lead to heap corruption and process crashes in systems utilizing the OpenEXR library, particularly in the motion picture industry. Defenders should prioritize verifying and upgrading to fixed versions of OpenEXR, specifically versions 3.2.10, 3.3.12, or 3.4.13, and assess exposure in systems utilizing the OpenEXR library.

Defensive priority

Defenders should prioritize verifying and upgrading to fixed versions of OpenEXR, specifically versions 3.2.10, 3.3.12, or 3.4.13, and assess exposure in systems utilizing the OpenEXR library.

Recommended defensive actions

• Verify and upgrade to OpenEXR versions 3.2.10, 3.3.12, or 3.4.13
• Assess exposure in systems utilizing the OpenEXR library
• Monitor for potential heap corruption and process crashes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, additional information on exploitation or victim impact is not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.