CVE-2026-55371
Received Received - Intake

NULL Pointer Dereference in OpenEXRCore

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero. When a caller supplies a positive hint_length together with a NULL type_hint, exr_attr_bytes_create() allocates a destination type-hint buffer and then copies from the NULL source pointer, causing a deterministic crash. The flaw is reachable through the public OpenEXRCore C API and results in a denial of service. The issue is fixed in version 3.4.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55371
EUVD
EUVD-2026-65184

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
academysoftwarefoundation openexr From 3.4.0 (inc) to 3.4.12 (inc)
academysoftwarefoundation openexr 3.4.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in OpenEXRCore's exr_attr_set_bytes() function. It occurs when a caller provides a positive hint_length with a NULL type_hint. The function fails to validate the nested type_hint pointer, leading to a crash when copying from a NULL source into an allocated buffer.

Detection Guidance

To detect this vulnerability, check the installed version of OpenEXR on your system. If it is between 3.4.0 and 3.4.12, the system is vulnerable. Use commands like 'exrinfo --version' or 'dpkg -l | grep openexr' on Linux to verify the version.

Impact Analysis

This flaw can cause a denial of service by crashing applications using OpenEXR versions 3.4.0 through 3.4.12. It is triggered through the public OpenEXRCore C API when processing untrusted or improperly validated bytes attribute data.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing applications through a NULL pointer dereference. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, repeated crashes could disrupt system availability, potentially affecting compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade OpenEXR to version 3.4.13 or later immediately. If upgrading is not possible, avoid using the exr_attr_set_bytes() function with positive hint_length and NULL type_hint. Review any applications using OpenEXRCore to ensure they do not pass invalid parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55371. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart