CVE-2026-54920: 
Wolfi vulnerability analysis and mitigation

CVE-2026-54920 is a memory-safety vulnerability in OpenEXRUtil's Image::resize() function, classified as an Integer Overflow and Use of Uninitialized Pointer leading to an Invalid Delete. It affects OpenEXR versions 2.x, 3.0.x, 3.1.x, 3.2.0–3.2.9, 3.3.0–3.3.11, and 3.4.0–3.4.12, and was patched in versions 3.2.10, 3.3.12, and 3.4.13. The vulnerability was discovered by researcher qiaozhiyi, assessed on 2026-06-08, and published via GitHub Security Advisory on 2026-06-23. The CVSS v3.1 base score is 0.0 (Low) as formally assigned, though the advisory recommends treating it as Medium severity due to confirmed denial-of-service impact (GitHub Advisory).

The root cause is a signed integer overflow (CWE-190) in Image::resize() within src/lib/OpenEXRUtil/ImfImage.cpp, where level and image dimensions are computed using signed 32-bit arithmetic (e.g., int a = max - min + 1). When extreme but representable Imath::Box2i coordinates are supplied (e.g., min.y = INT_MIN, max.y = 1), the calculation overflows. After the overflow, level construction throws an exception, triggering the cleanup path Image::clearLevels(), which iterates over an Array2D allocated via resizeErase() — a function that does not value-initialize pointer entries. This results in delete _levels[y][x] being called on uninitialized ImageLevel* slots (CWE-824); since ImageLevel has a virtual destructor, the runtime attempts to read a vptr from an invalid address (ASAN fill pattern 0xbebebebebebebebe), causing a segmentation fault. The vulnerability is reachable through the public OpenEXRUtil API, including FlatImage::resize(), and a minimal public PoC exists (GitHub Advisory).

The confirmed impact is denial of service via process crash — any application calling OpenEXRUtil Image::resize() or FlatImage::resize() with untrusted or insufficiently validated Box2i coordinates can be crashed. The crash involves a memory safety violation (signed integer overflow, uninitialized pointer read, invalid delete) and undefined behavior. Remote code execution was not confirmed by the researcher: while the virtual destructor dispatch path is theoretically concerning, attacker control over the uninitialized pointer value, fake vtable, or RIP was not demonstrated in the current assessment (GitHub Advisory).

A public proof-of-concept exists, consisting of a minimal C++ program calling FlatImage::resize() with a crafted Box2i (e.g., min = (1, INT_MIN), max = (1, 1)), which reproducibly causes a SIGSEGV in 10/10 local test runs. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to supply crafted coordinate values to an application using the OpenEXRUtil API; direct triggering from a standard .exr file through the normal file-loading path was not confirmed (GitHub Advisory).

1. Identify target: Find an application that uses the OpenEXRUtil library and exposes Image::resize() or FlatImage::resize() to attacker-controlled input (e.g., a server-side image conversion service or media processing pipeline).
2. Craft malicious input: Prepare an Imath::Box2i data window with extreme coordinates such as min = (1, INT_MIN) and max = (1, 1) to trigger signed integer overflow in the level-size calculation.
3. Trigger the resize call: Supply the crafted coordinates to the target application so it calls FlatImage::resize() (or equivalent) with the malicious Box2i values.
4. Overflow and exception: The signed integer overflow in ImfImage.cpp:34 causes level construction to fail and throw an exception.
5. Trigger invalid delete: Exception cleanup calls Image::clearLevels(), which iterates over the uninitialized _levels array and attempts delete _levels[y][x] on uninitialized pointer slots.
6. Process crash: The runtime reads a vptr from the invalid pointer address (e.g., 0xbebebebebebebebe), causing a segmentation fault and process abort, achieving denial of service (GitHub Advisory).

• Process: Application process using OpenEXRUtil terminates unexpectedly with SIGSEGV (exit code 139) or abort() during image resize operations.
• Logs: Crash logs or core dumps referencing Imf_4_0::Image::clearLevels() or ImfImage.cpp:606; ASAN/UBSAN output showing runtime error: signed integer overflow or member call on misaligned address 0xbebebebebebebebe.
• File System: Core dump files generated by the affected process in the working directory or /var/crash/; presence of AFL-derived fuzzing inputs (e.g., 24-byte binary files with specific hex patterns) in input directories.
• Network: Repeated or anomalous requests to image processing endpoints with unusual or extreme coordinate parameters in image metadata (GitHub Advisory).

Upgrade to the patched versions: 3.2.10, 3.3.12, or 3.4.13, which address both the integer overflow root cause and the uninitialized pointer cleanup issue. The fix involves using wider arithmetic (int64_t) for data-window dimension calculations, rejecting invalid dimensions before conversion, initializing _levels entries to nullptr immediately after allocation, and making clearLevels() safe for partially constructed state. As a workaround where upgrading is not immediately possible, applications should validate Box2i coordinates before passing them to Image::resize(), rejecting values that could cause overflow (e.g., min.y == INT_MIN). SUSE has also issued security updates (SUSE-SU-2026:22653-1, SUSE-SU-2026:3168-1, SUSE-SU-2026:3169-1) for affected distributions (GitHub Advisory, SUSE Advisory).

The vulnerability was reported by researcher qiaozhiyi and assessed by the Academy Software Foundation, which published the advisory on GitHub on 2026-06-23. The advisory explicitly notes that RCE was not confirmed and recommends treating the issue as Medium severity (DoS/memory corruption). Distribution vendors including SUSE and openSUSE issued security updates, and the issue was tracked by Tenable Nessus (plugins 327562, 329141, 329140) and covered by German Linux security outlet pro-linux.de. Community discussion was observed on Solus Linux forums and Slackware changelogs, indicating broad downstream awareness (GitHub Advisory, SUSE Advisory).