CVE-2026-55373: 
Wolfi vulnerability analysis and mitigation

CVE-2026-55373 is an infinite-loop (denial-of-service) vulnerability in OpenEXR's SampleCountChannel component, affecting the reference implementation of the EXR image format maintained by the Academy Software Foundation. The flaw exists in versions prior to 3.2.10, 3.3.11 (branch 3.3.x before 3.3.12), and 3.4.12 (branch 3.4.x before 3.4.13), as well as all 2.x, 3.0.x, and 3.1.x releases. It was published on June 23, 2026, and assigned a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory).

The root cause is an integer overflow/wraparound (CWE-190) in the helper function roundListSizeUp(unsigned int n) located in src/lib/OpenEXRUtil/ImfSampleCountChannel.cpp (lines 25–40), which leads to an unreachable loop exit condition (CWE-835) and uncontrolled resource consumption (CWE-400). The function uses repeated unsigned left-shifts (s <<= 1) to round n up to the next power of two; when n == UINT_MAX (4294967295), the shift sequence reaches 0x80000000, and the subsequent shift wraps the 32-bit value to 0. Since 0 < UINT_MAX is always true, the loop spins indefinitely. The bug is reachable via two public OpenEXRUtil C++ API paths: (1) setting a pixel's sample count to UINT_MAX through SampleCountChannel::Edit (whose destructor automatically calls endEdit(), which iterates over all pixels calling roundListSizeUp()), and (2) directly calling SampleCountChannel::set(x, y, UINT_MAX). Public PoC code demonstrating both paths was included in the advisory (GitHub Advisory).

Successful exploitation causes a deterministic CPU denial-of-service: the affected process enters an infinite loop and never exits, consuming 100% of a CPU core until externally killed. There is no memory corruption, out-of-bounds access, information disclosure, or code execution primitive — confidentiality and integrity are unaffected. Applications that process untrusted EXR image data and pass attacker-controlled deep sample counts into SampleCountChannel without prior validation are at risk of complete availability loss for the affected process (GitHub Advisory).

Public PoC code is available in the GitHub Security Advisory, demonstrating both the edit-buffer and direct-setter trigger paths; both were confirmed to hang indefinitely (exit code 124 under a 3-second timeout) on all affected release tags and the latest main branch at the time of disclosure. No in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, reflecting very low current exploitation probability. Exploitation requires local or application-level access to pass a UINT_MAX sample count into the API, limiting the practical attack surface to scenarios where untrusted input reaches the OpenEXRUtil layer without sanitization (GitHub Advisory).

1. Identify target: Locate an application or service that uses OpenEXRUtil (versions < 3.2.10, < 3.3.12, or < 3.4.13) and exposes a code path where attacker-controlled data reaches SampleCountChannel::set() or SampleCountChannel::Edit.
2. Craft input: Prepare a deep EXR image or API call that sets a pixel's sample count to UINT_MAX (4294967295). Using the edit-buffer path: instantiate SampleCountChannel::Edit, write UINT_MAX into edit.sampleCounts()[0], and allow the Edit destructor to fire (e.g., by scope exit).
3. Trigger the loop: The destructor calls SampleCountChannel::endEdit(), which iterates over all pixels and calls roundListSizeUp(UINT_MAX). The unsigned left-shift loop wraps to zero and never exits.
4. Achieve DoS: The target process's CPU usage spikes to 100% on one core and the process becomes unresponsive until killed externally, causing denial of service for any service relying on that process (GitHub Advisory).

• Process: A process linked against libOpenEXRUtil (e.g., libOpenEXRUtil-4_0.so) consuming 100% CPU indefinitely without progressing or producing output.
• Process: GDB or profiler stack traces showing the process spinning in roundListSizeUp() → SampleCountChannel::endEdit() or SampleCountChannel::set() within ImfSampleCountChannel.cpp.
• Logs: Application logs showing a hung or unresponsive EXR processing job with no completion or error message after an unusually long runtime.
• System: Repeated process kills or watchdog restarts of EXR-processing services without a crash dump or exception log (GitHub Advisory).

Upgrade to one of the patched releases: 3.2.10, 3.3.12, or 3.4.13, which fix the roundListSizeUp() function to handle UINT_MAX correctly. As a workaround prior to patching, applications should validate that sample counts passed to SampleCountChannel::set() or written into SampleCountChannel::Edit buffers do not equal UINT_MAX (or exceed a reasonable application-defined maximum) before invoking the API. SUSE has also issued a security update (SUSE-SU-2026:3169-1) for affected distributions (GitHub Advisory, SUSE Advisory).

The vulnerability was reported by researcher qiaozhiyi and published by the Academy Software Foundation via GitHub Security Advisories on June 23, 2026. Linux distribution vendors including SUSE and openSUSE issued security updates, and Tenable published Nessus detection plugins (IDs 327562 and 329141). No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified.