Every CVE Search/ Get API key

CVE-2020-16588

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in...

5.5 MediumFix available

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.22%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.

Record
CVE-2020-16588
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.

Record
CVE-2020-16588
Updated
2026-11-02
EUVDEUVD-2020-8549 No score

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.

Record
EUVD-2020-8549
Updated
2026-11-03
GitHub AdvisoriesGHSA-p928-c9c9-qw29 5.5

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in...

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.

Record
GHSA-p928-c9c9-qw29
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVAZL-44706 5.5

CVE-2020-16588 affecting package OpenEXR 2.3.0-6

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.

Record
AZL-44706
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSV 5.5

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.

Record
CVE-2020-16588
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2020-16588 5.5

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.

Record
DEBIAN-CVE-2020-16588
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-16588 5.5

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.

Record
UBUNTU-CVE-2020-16588
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2021-0015 No score

Updated openexr packages fix security vulnerabilities

An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference (CVE-2020-15304).

An issue was discovered in OpenEXR before 2.5.2. Invalid input could cause a use-after-free in DeepScanLineInputFile::DeepScanLineInputFile() in IlmImf/ImfDeepScanLineInputFile.cpp (CVE-2020-15305).

An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp (CVE-2020-15306).

A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted EXR file (CVE-2020-16587).

A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file (CVE-2020-16588).

A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file (CVE-2020-16589).

Record
MGASA-2021-0015
Updated
2026-11-02
OSVopenSUSE-SU-2020:2349-1 No score

Security update for openexr

This update for openexr fixes the following issues:

Security issues fixed:

  • CVE-2020-16587: Fixed a heap-based buffer overflow in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp (bsc#1179879).
  • CVE-2020-16588: Fixed a null pointer deference in generatePreview (bsc#1179879).
  • CVE-2020-16589: Fixed a heap-based buffer overflow in writeTileData in ImfTiledOutputFile.cpp (bsc#1179879).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2349-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2351-1 No score

Security update for openexr

This update for openexr fixes the following issues:

Security issues fixed:

  • CVE-2020-16587: Fixed a heap-based buffer overflow in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp (bsc#1179879).
  • CVE-2020-16588: Fixed a null pointer deference in generatePreview (bsc#1179879).
  • CVE-2020-16589: Fixed a heap-based buffer overflow in writeTileData in ImfTiledOutputFile.cpp (bsc#1179879).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2351-1
Updated
2026-11-02
OSVSUSE-SU-2020:3931-1 No score

Security update for openexr

This update for openexr fixes the following issues:

Security issues fixed:

  • CVE-2020-16587: Fixed a heap-based buffer overflow in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp (bsc#1179879).
  • CVE-2020-16588: Fixed a null pointer deference in generatePreview (bsc#1179879).
  • CVE-2020-16589: Fixed a heap-based buffer overflow in writeTileData in ImfTiledOutputFile.cpp (bsc#1179879).
Record
SUSE-SU-2020:3931-1
Updated
2026-11-02
OSVSUSE-SU-2020:3934-1 No score

Security update for openexr

This update for openexr fixes the following issues:

Security issues fixed:

  • CVE-2020-16587: Fixed a heap-based buffer overflow in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp (bsc#1179879).
  • CVE-2020-16588: Fixed a null pointer deference in generatePreview (bsc#1179879).
  • CVE-2020-16589: Fixed a heap-based buffer overflow in writeTileData in ImfTiledOutputFile.cpp (bsc#1179879).
Record
SUSE-SU-2020:3934-1
Updated
2026-11-02
OSVUSN-4676-1 No score

openexr vulnerabilities

It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code.

Record
USN-4676-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
OpenEXR
Azure Linux:3
 through 2.3.0-6 None known
openexr
Debian:12
 before 2.5.3-2
2.5.3-2
openexr
Debian:13
 before 2.5.3-2
2.5.3-2
openexr
Debian:14
 before 2.5.3-2
2.5.3-2
openexr
Debian:9
From an advisory covering 2 CVEs
 before 2.2.0-11+deb9u2, plus listed versions
2.2.0-112.2.0-11+deb9u1
2.2.0-11+deb9u2
openexr
Debian:10
From an advisory covering 22 CVEs
 before 2.2.1-4.1+deb10u2, plus listed versions
2.2.1-4.12.2.1-4.1+deb10u1
2.2.1-4.1+deb10u2
openexr
Mageia:7
From an advisory covering 6 CVEs
 before 2.3.0-2.3.mga7
2.3.0-2.3.mga7
openexr
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 3 CVEs
 before 2.1.0-6.26.1
2.1.0-6.26.1
openexr
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 3 CVEs
 before 2.1.0-6.26.1
2.1.0-6.26.1
openexr
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 3 CVEs
 before 2.1.0-6.26.1
2.1.0-6.26.1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
openexr
SUSE:Linux Enterprise Workstation Extension 12 SP5
From an advisory covering 3 CVEs
 before 2.1.0-6.26.1
2.1.0-6.26.1
openexr
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 3 CVEs
 before 2.2.1-3.21.1
2.2.1-3.21.1
openexr
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 3 CVEs
 before 2.2.1-3.21.1
2.2.1-3.21.1
openexr
Ubuntu:16.04:LTS
 before 2.2.0-10ubuntu2.4, plus listed versions
2.2.0-1ubuntu32.2.0-7ubuntu12.2.0-9ubuntu12.2.0-10ubuntu22.2.0-10ubuntu2.12.2.0-10ubuntu2.22.2.0-10ubuntu2.3
2.2.0-10ubuntu2.4
openexr
Ubuntu:18.04:LTS
 before 2.2.0-11.1ubuntu1.4, plus listed versions
2.2.0-11ubuntu12.2.0-11.1ubuntu12.2.0-11.1ubuntu1.12.2.0-11.1ubuntu1.22.2.0-11.1ubuntu1.3
2.2.0-11.1ubuntu1.4
openexr
Ubuntu:20.04:LTS
 before 2.3.0-6ubuntu0.3, plus listed versions
2.2.1-4.1ubuntu12.3.0-62.3.0-6build12.3.0-6ubuntu0.12.3.0-6ubuntu0.2
2.3.0-6ubuntu0.3
openexr
Ubuntu:16.04:LTS
From an advisory covering 3 CVEs
 before 2.2.0-10ubuntu2.4, plus listed versions
2.2.0-1ubuntu32.2.0-7ubuntu12.2.0-9ubuntu12.2.0-10ubuntu22.2.0-10ubuntu2.12.2.0-10ubuntu2.22.2.0-10ubuntu2.3
2.2.0-10ubuntu2.4
openexr
Ubuntu:18.04:LTS
From an advisory covering 3 CVEs
 before 2.2.0-11.1ubuntu1.4, plus listed versions
2.2.0-11ubuntu12.2.0-11.1ubuntu12.2.0-11.1ubuntu1.12.2.0-11.1ubuntu1.22.2.0-11.1ubuntu1.3
2.2.0-11.1ubuntu1.4
openexr
Ubuntu:20.04:LTS
From an advisory covering 3 CVEs
 before 2.3.0-6ubuntu0.3, plus listed versions
2.2.1-4.1ubuntu12.3.0-62.3.0-6build12.3.0-6ubuntu0.12.3.0-6ubuntu0.2
2.3.0-6ubuntu0.3
openexr
openSUSE:Leap 15.1
From an advisory covering 3 CVEs
 before 2.2.1-lp151.4.15.1
2.2.1-lp151.4.15.1
openexr
openSUSE:Leap 15.2
From an advisory covering 3 CVEs
 before 2.2.1-lp152.7.8.1
2.2.1-lp152.7.8.1

History

History
RecordedChangedSources
affected
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-16588 is a medium vulnerability (CVSS 5.5) in Openexr, published December 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. Fixed in openexr 2.5.3-2.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open