CVE-2026-88384: Null Pointer Dereference
OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service.
Affected Software
Event History
Frequently Asked Questions
Which OpenEXR version is explicitly identified as affected?
The reported affected version is OpenEXR 3.4.14. The provided data does not identify a fixed version.
What is the documented upstream remediation status?
The report references OpenEXR upstream issue 2612 and pull request 2615, including a specific change in that pull request. The provided data does not state whether the change was released or backported.