CVE-2026-55373: CWE-190: Integer Overflow or Wraparound in AcademySoftwareFoundation openexr

CVE-2026-55373 describes an integer overflow or wraparound vulnerability in the AcademySoftwareFoundation's OpenEXR library, specifically in the SampleCountChannel's roundListSizeUp() helper function. The function attempts to round a sample-list size up to the next power of two using repeated unsigned left shifts. For normal values, this terminates correctly, but when the input is UINT_MAX, the left shift operation wraps the 32-bit value to zero, causing the loop to never exit. This infinite loop can be triggered through public OpenEXRUtil APIs, either by editing the sample-count buffer or by calling SampleCountChannel::set(x, y, UINT_MAX) on a valid pixel. The vulnerability is addressed in OpenEXR versions 3.2.10, 3.3.12, and 3.4.13.

The vulnerability results in an infinite loop condition causing denial of service (DoS) due to resource exhaustion when processing crafted inputs that set the sample count to UINT_MAX. There is no impact on confidentiality or integrity. The CVSS v3.1 score is 6.2 (medium severity) with the vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating local attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact.

This issue has been fixed in OpenEXR versions 3.2.10, 3.3.12, and 3.4.13. Users should upgrade to one of these versions or later to remediate the vulnerability. No other mitigation or workaround is indicated in the available data.