CVE-2026-55059

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.10 OpenEXR versions prior to 3.3.12 OpenEXR versions prior to 3.4.13

Description A heap out-of-bounds write exists in the Imf 4 0::SampleCountChannel::set(int r, unsigned int newNumSamples[]) function. The row-based sample-count setter incorrectly uses dataWindow.min.x instead of dataWindow.min.y to compute the target Y coordinate. In deep image data windows where min.x differs from min.y, a valid row index can result in an invalid Y coordinate, leading to writes before the allocated numSamples buffer. This issue is reachable via the public OpenEXRUtil DeepImage API and can result in heap corruption and process crashes.

Recommendations Update to version 3.2.10. Update to version 3.3.12. Update to version 3.4.13.