CVE-2026-55371
- Source
- https://cve.org/CVERecord?id=CVE-2026-55371
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55371.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55371
- Aliases
-
- GHSA-xx72-f24p-cf6r
- Downstream
- Related
- Published
- 2026-08-25T00:31:35.995Z
- Modified
- 2026-08-27T11:47:39.654173927Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length
- Details
-
OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exrattrsetbytes(). The public setter validates the top-level exrattrbytest value pointer but does not verify that the nested typehint pointer is non-NULL when hintlength is greater than zero. When a caller supplies a positive hintlength together with a NULL typehint, exrattrbytes_create() allocates a destination type-hint buffer and then copies from the NULL source pointer, causing a deterministic crash. The flaw is reachable through the public OpenEXRCore C API and results in a denial of service. The issue is fixed in version 3.4.13.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55371.json", "cwe_ids": [ "CWE-20", "CWE-476" ], "cna_assigner": "GitHub_M" }- References