CVE-2026-55373

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.10 OpenEXR versions prior to 3.3.12 OpenEXR versions prior to 3.4.13

Description An infinite-loop issue exists in SampleCountChannel due to the roundListSizeUp() function. This function rounds a sample-list size to the next power of two using repeated unsigned left shifts. When the value UINT MAX is processed, the sequence reaches 0x80000000, and the subsequent left shift wraps the 32-bit value to 0. Since 0 remains less than UINT MAX, the loop never terminates. This can be triggered via public OpenEXRUtil APIs by calling SampleCountChannel::set(x, y, UINT MAX) on a valid pixel or by editing the sample-count buffer through SampleCountChannel::Edit (where the destructor calls endEdit()).

Recommendations Update OpenEXR to version 3.2.10. Update OpenEXR to version 3.3.12. Update OpenEXR to version 3.4.13.