Heap Out-of-Bounds Write Vulnerability in OpenEXR by Academy Software Foundation
CVE-2026-55059

6.1MEDIUM

Key Information:

Vendor

Academysoftwarefoundation

Status
Openexr
Vendor
CVE Published:
25 August 2026

What is CVE-2026-55059?

The OpenEXR library, essential for handling EXR image formats in the motion picture industry, is susceptible to a heap out-of-bounds write vulnerability due to incorrect calculations in its sample count channel setter. This flaw occurs in specific versions before 3.2.10, 3.3.12, and 3.4.13, where the Y coordinate is derived from the X coordinate, potentially enabling the exploitation of invalid memory access. Accessing this vulnerability is possible through the public OpenEXRUtil DeepImage API, leading to potential heap corruption and application crashes. Recent updates have patched this issue, ensuring that users of affected versions migrate to the latest secure iterations.

Affected Version(s)

openexr < 3.2.10 < 3.2.10

openexr >= 3.3.0, < 3.3.12 < 3.3.0, 3.3.12

openexr >= 3.4.0, < 3.4.13 < 3.4.0, 3.4.13

References

https://github.com/AcademySoftwareFoundation/openexr/secu...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.