CVE-2026-55371— OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length
Quick assessment
Affected
AcademySoftwareFoundation openexr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenEXR 是 EXR 高动态范围图像文件格式的参考实现和规范，广泛应用于电影行业。OpenEXR 3.4.0 至 3.4.12 版本中存在一个空指针解引用漏洞，该漏洞出现在 OpenEXRCore 函数 exr_attr_set_bytes() 中。公开的 setter 函数会验证顶层 exr_attr_bytes_t 值指针，但当 hint_length 大于零时，并未核实嵌套的 type_hint 指针是否为非空。当调用者提供一个正数的 hint_length 同时携带一个 NULL 的 type_hin
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.4.0, < 3.4.13 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55371
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length
Source: CVE Program / CVE List V5
Vulnerability Description
OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero. When a caller supplies a positive hint_length together with a NULL type_hint, exr_attr_bytes_create() allocates a destination type-hint buffer and then copies from the NULL source pointer, causing a deterministic crash. The flaw is reachable through the public OpenEXRCore C API and results in a denial of service. The issue is fixed in version 3.4.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.4.0, < 3.4.13 | - |
|
II. Public POCs for CVE-2026-55371
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55371
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-55371 (1)
Same Patch Batch · AcademySoftwareFoundation · 2026-08-25 · 20 CVEs total
| CVE-2026-59981 | 7.1 HIGH | OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow |
| CVE-2026-59184 | 7.1 HIGH | OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write |
| CVE-2026-59186 | 7.1 HIGH | OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (IL |
| CVE-2026-59187 | 7.1 HIGH | OpenEXR: exrmetrics deep pixelmode heap buffer overflow |
| CVE-2026-59189 | 7.1 HIGH | OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin |
| CVE-2026-59982 | 7.1 HIGH | OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms |
| CVE-2026-68515 | 7.1 HIGH | OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union |
| CVE-2026-68513 | 7.1 HIGH | OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collisio |
| CVE-2026-65979 | 6.7 MEDIUM | OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN) |
| CVE-2026-55373 | 6.2 MEDIUM | OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample coun |
| CVE-2026-55059 | 6.1 MEDIUM | OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnera |
| CVE-2026-59984 | 5.5 MEDIUM | OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32 |
| CVE-2026-68514 | 5.5 MEDIUM | OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collisio |
| CVE-2026-61555 | 5.5 MEDIUM | OpenEXR: Empty multiView viewFromChannelName file crash |
| CVE-2026-59985 | 5.5 MEDIUM | OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32 |
| CVE-2026-59983 | 5.5 MEDIUM | OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32 |
| CVE-2026-59183 | 5.5 MEDIUM | OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decod |
| CVE-2026-62986 | 4.3 MEDIUM | OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure |
| CVE-2026-54920 | OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil im |
IV. Related Vulnerabilities
Same product: openexr
-
CVE-2026-59981
OpenEXR: Heap OOB read in SampleCountChannel row when using -
CVE-2026-68514
OpenEXR: Heap buffer overflow in PyOpenEXR from literal/pref -
CVE-2026-68515
OpenEXR: Heap out-of-bounds write in exrmultiview with subsa -
CVE-2026-68513
OpenEXR: Heap buffer overflow in PyOpenEXR from literal/pref -
CVE-2026-65979
OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidate
Same vendor: AcademySoftwareFoundation
-
CVE-2026-59981
OpenEXR: Heap OOB read in SampleCountChannel row when using -
CVE-2026-68514
OpenEXR: Heap buffer overflow in PyOpenEXR from literal/pref -
CVE-2026-68515
OpenEXR: Heap out-of-bounds write in exrmultiview with subsa -
CVE-2026-68513
OpenEXR: Heap buffer overflow in PyOpenEXR from literal/pref -
CVE-2026-65979
OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidate
V. Comments for CVE-2026-55371
No comments yet