CVE-2026-55371

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.4.0 through 3.4.12

Description OpenEXR contains a NULL pointer dereference in the OpenEXRCore function exr attr set bytes(). The issue occurs because the public setter validates the top-level exr attr bytes t value pointer but fails to verify that the nested type hint pointer is non-NULL when hint length is greater than zero. If a caller provides a positive hint length with a NULL type hint, the exr attr bytes create() function allocates a destination buffer and attempts to copy data from the NULL source pointer, leading to a deterministic crash and a denial of service. This flaw is reachable via the public OpenEXRCore C API.

Recommendations Update OpenEXR to version 3.4.13.