CVE-2026-55059: 
Wolfi vulnerability analysis and mitigation

CVE-2026-55059 is a heap out-of-bounds write vulnerability in OpenEXR's OpenEXRUtil library, specifically in the Imf_4_0::SampleCountChannel::set(int r, unsigned int newNumSamples[]) function. It affects all 2.x and 3.x releases prior to the patched versions: 3.2.10, 3.3.12, and 3.4.13. The flaw was published on June 23, 2026 via a GitHub Security Advisory and assigned a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause (CWE-787: Out-of-bounds Write) is a copy-paste error in src/lib/OpenEXRUtil/ImfSampleCountChannel.cpp: the row-based sample-count setter computes the target Y coordinate using dataWindow.min.x instead of dataWindow.min.y. When a deep image's data window has differing X and Y origins (i.e., min.x != min.y), a valid row index r is translated into an incorrect Y coordinate, causing the lower-level setter to compute a negative buffer index (e.g., _numSamples[-2]) and write before the allocated _numSamples buffer. The vulnerability is reachable through the public OpenEXRUtil DeepImage API — specifically SampleCountChannel::set(row, array) — and a minimal C++ proof-of-concept reproducer was included in the advisory. The lower-level setter also lacks the bounds check documented in the public header (GitHub Advisory).

Successful exploitation leads to heap memory corruption, which can cause process crashes (denial of service). The confirmed impact is availability loss; the advisory notes no confirmed confidentiality breach, though heap corruption can theoretically be leveraged for further memory exploitation. The vulnerability affects applications that use SampleCountChannel::set(row, array) with deep EXR images whose data window X and Y origins differ, and is not confirmed to be directly reachable through the standard EXR file-loading path without application-level use of the DeepImage API (GitHub Advisory).

No in-the-wild exploitation has been reported, and the EPSS score is 0.0, indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A public proof-of-concept reproducer is included in the GitHub Security Advisory, but exploitation requires local access and user interaction (e.g., processing a crafted deep EXR image via an application using the DeepImage API). No exploit kits or threat actor attribution have been identified (GitHub Advisory).

1. Craft a malicious deep EXR image: Create a deep EXR image with a data window where min.x != min.y (e.g., dataWindow = (0, 1) - (1, 1)).
2. Target a vulnerable application: Identify an application that uses the OpenEXRUtil DeepImage API — specifically one that calls SampleCountChannel::set(row, array) — and is linked against an unpatched OpenEXR version (< 3.2.10, < 3.3.12, or < 3.4.13).
3. Trigger the vulnerable code path: Supply the crafted image to the application so it invokes SampleCountChannel::set(0, counts) on the deep image level, causing the Y coordinate to be computed as dataWindow.min.x + r instead of dataWindow.min.y + r.
4. Achieve heap corruption: The incorrect Y value causes the lower-level setter to compute a negative index into _numSamples, writing before the allocated buffer and corrupting heap memory, which can result in a process crash or, in theory, further memory exploitation (GitHub Advisory).

• Process: Unexpected crashes or aborts in applications processing EXR files, particularly with error messages such as free(): invalid pointer or heap corruption assertions from the C runtime.
• Logs: Application crash logs referencing ImfSampleCountChannel.cpp or stack frames involving Imf_4_0::SampleCountChannel::set.
• File System: Presence of crafted deep EXR files with unusual data window configurations (e.g., min.x != min.y) in directories processed by vulnerable applications.
• Memory Debugging: ASAN or Valgrind reports of out-of-bounds writes before the _numSamples buffer in OpenEXRUtil (GitHub Advisory).

Upgrade OpenEXR to one of the patched versions: 3.2.10, 3.3.12, or 3.4.13, which correct the Y coordinate calculation in SampleCountChannel::set() to use dataWindow.min.y instead of dataWindow.min.x. SUSE has issued security updates (SUSE-SU-2026:3169-1) for affected distributions. As a workaround where upgrading is not immediately possible, applications should avoid calling SampleCountChannel::set(row, array) on deep images with data windows where min.x != min.y, or add application-level validation of the data window before invoking the API (GitHub Advisory).

The vulnerability was reported by researcher qiaozhiyi and published by the Academy Software Foundation on June 23, 2026. SUSE issued a security update (SUSE-SU-2026:3169-1) and openSUSE published a corresponding security announcement. Tenable released Nessus detection plugins (IDs 327562 and 329141) for the vulnerability. Coverage has been limited to security aggregators and Linux distribution security channels, with no significant broader media or social media discussion observed.