OpenEXR 3.4.14 contains a NULL pointer dereference during attribute parsing. A maliciously crafted EXR file that defines an unknown attribute type with a dataSize of zero causes the parser to create an opaque attribute whose packed data pointer is null. The constructor passes this null pointer to memcpy, leading to undefined behavior and terminating the process. The result is a loss of service for any application that processes the harmful file.

Any software that incorporates OpenEXR 3.4.14 and processes user‑supplied EXR images is affected. This includes graphics editors, rendering engines, media servers, and other image‑handling utilities that use the vulnerable library version. No additional vendor or product information is specified beyond the library itself.

The CVSS base score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests exploitation likelihood is very low at present. Based on the description, the likely attack vector is the supply of a crafted EXR file, which could be delivered via upload or local file access. The impact is limited to service interruption of the affected component, and the vulnerability is not listed in CISA’s KEV catalog, further reducing the probability of widespread exploitation.