Description
OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero. When a caller supplies a positive hint_length together with a NULL type_hint, exr_attr_bytes_create() allocates a destination type-hint buffer and then copies from the NULL source pointer, causing a deterministic crash. The flaw is reachable through the public OpenEXRCore C API and results in a denial of service. The issue is fixed in version 3.4.13.
Published: 2026-08-25
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via NULL pointer dereference
Action: Immediate Patch
AI Analysis

Impact

A NULL pointer dereference occurs in the OpenEXRCore function exr_attr_set_bytes() when a caller supplies a positive hint_length together with a NULL type_hint. The function allocates a destination hint buffer and then attempts to copy data from the NULL source pointer, leading to a deterministic crash. This flaw results in a denial of service and is formally classified as CWE-20 (Improper Input Validation) and CWE-476 (NULL Pointer Dereference).

Affected Systems

The vulnerability affects AcademySoftwareFoundation’s OpenEXR library versions 3.4.0 through 3.4.12. Because the flaw is present in the public C API, any application that loads, creates, or modifies EXR byte attributes—common in motion‑picture production pipelines—could be impacted.

Risk and Exploitability

The flaw is reachable through the public OpenEXRCore API; an attacker who can provide a crafted EXR file to a UI or can invoke the API directly may trigger the crash. Based on the description, the likely attack vector is either via a malicious file or direct API misuse. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating no widespread exploitation yet. The CVSS score of 6.9 signifies moderate severity, but the deterministic crash makes timely patching a priority.

Generated by OpenCVE AI on August 25, 2026 at 02:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenEXR to version 3.4.13 or later, where the flaw is fixed.
  • Modify any code that calls exr_attr_set_bytes() to ensure a non‑NULL type_hint is supplied whenever hint_length is greater than zero, preventing accidental null inputs.
  • If upgrading is not immediately possible, run vulnerable applications in a sandbox or container to isolate the crash impact, or disable processing of external EXR files until a patch is applied.

Generated by OpenCVE AI on August 25, 2026 at 02:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Description OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero. When a caller supplies a positive hint_length together with a NULL type_hint, exr_attr_bytes_create() allocates a destination type-hint buffer and then copies from the NULL source pointer, causing a deterministic crash. The flaw is reachable through the public OpenEXRCore C API and results in a denial of service. The issue is fixed in version 3.4.13.
Title OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length
Weaknesses CWE-20
CWE-476
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T19:22:48.186Z

Reserved: 2026-06-16T18:57:40.181Z

Link: CVE-2026-55371

cve-icon Vulnrichment

Updated: 2026-08-25T18:32:46.622Z

cve-icon NVD

Status : Deferred

Published: 2026-08-25T01:16:36.810

Modified: 2026-09-09T21:07:31.353

Link: CVE-2026-55371

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-25T00:31:35Z

Links: CVE-2026-55371 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T03:00:12Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-476

    NULL Pointer Dereference