---
id: CVE-2026-55371
title: >-
  OpenEXR is the reference implementation and specification for the EXR
  high-dynamic-range image file format, widely used in the motion picture
  industry
summary: >-
  OpenEXR is the reference implementation and specification for the EXR
  high-dynamic-range image file format, widely used in the motion picture
  industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in
  the OpenEXRCore f…
severity: none
cwe:
  - CWE-20
  - CWE-476
published: '2026-08-25'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:07:31.353'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55371'
references:
  - url: >-
      https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-xx72-f24p-cf6r
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00167
epssPercentile: 0.05312
ingestedAt: '2026-09-09T21:22:45.550Z'
---

## Overview

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero. When a caller supplies a positive hint_length together with a NULL type_hint, exr_attr_bytes_create() allocates a destination type-hint buffer and then copies from the NULL source pointer, causing a deterministic crash. The flaw is reachable through the public OpenEXRCore C API and results in a denial of service. The issue is fixed in version 3.4.13.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.