OpenEXR CVE-2026-55059

Exploitation requires that the target application process a deep image EXR file - one ingested through the OpenEXRUtil DeepImage API, not standard flat or scanline EXR images. The deep image's data window must have min.x ≠ min.y; this is a structurally valid and non-unusual configuration for offset data windows in VFX workflows, meaning it cannot be filtered by simple header validation. CVSS PR:N indicates no authentication is required to supply the crafted file to a vulnerable application. CVSS UI:R indicates that either a human must open the file or an automated pipeline must ingest it. Exploitation is bounded by AV:L - the attacker cannot directly reach the vulnerable parser over the network; the file must first be delivered to and processed on the target system. Flat/scanline EXR images do not reach the vulnerable code path.

The CVSS 6.1 Medium score reflects AV:L (local file processing), UI:R (a user or process must open the file), no confidentiality impact, Low integrity impact, and High availability impact - a profile consistent with a file-parsing crash/corruption class of vulnerability. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The vulnerability is absent from CISA KEV, and no public proof-of-concept code has been identified, placing it in the lowest exploitation urgency tier by available signals. Real-world risk is elevated specifically in automated media ingest pipelines that process externally sourced EXR deep images without sandboxing, where UI:R is effectively satisfied by the pipeline itself rather than a human. The SUSE security updates (SUSE-SU-2026:22653 and SUSE-SU-2026:3169) confirm vendor acknowledgment and urgency on Linux distributions. The I:L rating suggests the heap write is not immediately reliably controllable for arbitrary code execution, though memory corruption primitives cannot be fully discounted in all runtime environments.

An attacker crafts a malicious OpenEXR deep image file with a data window configured such that min.x ≠ min.y, then delivers it via email, a shared asset repository, or a web-based media upload endpoint. When a user opens the file in a compositing tool (e.g., Nuke, Houdini, or a custom pipeline tool) or an automated ingest service processes it, the vulnerable SampleCountChannel::set() function writes before the _numSamples heap buffer, crashing the process or corrupting adjacent heap metadata. No public proof-of-concept has been identified.