# CVE-2026-55373

## Summary

- **CVE ID:** CVE-2026-55373
- **Severity:** MEDIUM
- **CVSS Score:** 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** CWE-190, CWE-400, CWE-835
- **Published:** Aug 25, 2026
- **Last Modified:** Aug 25, 2026

## Description

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an infinite-loop vulnerability in SampleCountChannel. The helper roundListSizeUp() rounds a sample-list size up to the next power of two using repeated unsigned left shifts, which terminates for normal values but fails for UINT_MAX: the sequence reaches 0x80000000, and the next left shift wraps the 32-bit value to 0. Because 0 remains less than UINT_MAX, the loop never progresses and never exits. The bug is reachable through public OpenEXRUtil APIs, either by editing the sample-count buffer through SampleCountChannel::Edit (whose destructor calls endEdit()) or by calling SampleCountChannel::set(x, y, UINT_MAX) on a valid pixel. This issue has been fixed in versions 3.2.10, 3.3.12, and 3.4.13.

## Affected Products

- AcademySoftwareFoundation — openexr (< 3.2.10)
- AcademySoftwareFoundation — openexr (>= 3.3.0, < 3.3.12)
- AcademySoftwareFoundation — openexr (>= 3.4.0, < 3.4.13)

## References

- [CNA](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-mff9-68x3-h8rh)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.11%
- **EPSS Percentile:** 1.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._