CVE-2026-55373 AcademySoftwareFoundation CVE debrief

Who should care

Defenders responsible for systems and applications using OpenEXR for image processing should assess exposure and prioritize patching or mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-55373 is a medium-severity vulnerability affecting OpenEXR, a widely used image format in the motion picture industry. The issue, caused by an infinite-loop vulnerability in SampleCountChannel, can be triggered through public OpenEXRUtil APIs. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where OpenEXR is used for image processing.

• Potential denial-of-service (DoS) due to infinite loop
• Possible system crashes or freezes
• Increased resource utilization due to prolonged loop execution

Technical summary

The vulnerability is caused by an infinite-loop condition in the SampleCountChannel due to improper handling of UINT_MAX values. This issue can be triggered through public OpenEXRUtil APIs, either by editing the sample-count buffer through SampleCountChannel::Edit or by calling SampleCountChannel::set(x, y, UINT_MAX) on a valid pixel. The bug is reachable through public OpenEXRUtil APIs and has been fixed in OpenEXR versions 3.2.10, 3.3.12, and 3.4.13. Affected product context and defensive impact should be considered.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where OpenEXR is used for image processing.

Recommended defensive actions

• Patch or upgrade OpenEXR to versions 3.2.10, 3.3.12, or 3.4.13
• Restrict access to OpenEXRUtil APIs
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by an infinite-loop condition in the SampleCountChannel due to improper handling of UINT_MAX values. This issue can be triggered through public OpenEXRUtil APIs, either by editing the sample-count buffer through SampleCountChannel::Edit or by calling SampleCountChannel::set(x, y, UINT_MAX) on a valid pixel. The vulnerability has been fixed in OpenEXR versions 3.2.10, 3.3.12, and 3.4.13. Defenders should verify affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.