{"id":"CVE-2026-55371","title":"OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry","summary":"OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore f…","severity":"none","cwe":["CWE-20","CWE-476"],"published":"2026-08-25","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:07:31.353","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55371","references":[{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-xx72-f24p-cf6r","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00117,"epssPercentile":0.01868,"ingestedAt":"2026-09-09T21:22:45.550Z","slug":"CVE-2026-55371","body":"## Overview\n\nOpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero. When a caller supplies a positive hint_length together with a NULL type_hint, exr_attr_bytes_create() allocates a destination type-hint buffer and then copies from the NULL source pointer, causing a deterministic crash. The flaw is reachable through the public OpenEXRCore C API and results in a denial of service. The issue is fixed in version 3.4.13.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}