CVE-2026-88384
Received Received - Intake

NULL Pointer Dereference in OpenEXR C++ Attribute Parsing

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description
OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-88384
EUVD
EUVD-2026-86273

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openexr openexr 3.4.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEXR 3.4.14 has a NULL pointer dereference flaw in its C++ attribute parsing. A maliciously crafted EXR file with an unknown-type attribute and zero dataSize triggers this issue. The parser creates an opaque attribute with a NULL packed_data pointer, which is then passed to memcpy() without validation. This causes undefined behavior, leading to process termination and denial of service.

Detection Guidance

This vulnerability involves a NULL pointer dereference in OpenEXR's C++ attribute parsing when processing malformed EXR files. To detect it, scan systems for OpenEXR installations and monitor for crashes or errors when processing EXR files. Check logs for segmentation faults or undefined behavior during file parsing.

Impact Analysis

If you process untrusted EXR files using OpenEXR 3.4.14, an attacker could exploit this flaw to crash the application or system, causing denial of service. This may disrupt workflows relying on OpenEXR for image processing or file handling.

Mitigation Strategies

Update OpenEXR to the latest patched version (3.4.14 or later). Avoid opening untrusted EXR files until patched. Implement file validation checks before processing EXR files. Restrict access to systems handling EXR files to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88384. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart