{"id":"CVE-2026-88384","aliases":["DEBIAN-CVE-2026-88384","EUVD-2026-86273","GHSA-3cfr-j9gx-46w4","SUSE-SU-2026:24012-1","SUSE-SU-2026:4532-1","SUSE-SU-2026:4828-1","UBUNTU-CVE-2026-88384","openSUSE-SU-2026:11934-1","openSUSE-SU-2026:22013-1"],"status":"published","title":"OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially...","description":"OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00193,"percentile":0.09054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2026-09-24T00:00:00Z","modified":"2026-11-07T13:00:09Z","fixes":[{"ecosystem":"Debian:14","package":"openexr","fixed_in":["3.4.16+ds-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openexr","fixed_in":["3.2.2-160000.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openexr","fixed_in":["3.2.2-160000.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openexr","fixed_in":["2.1.0-6.54.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"openexr","fixed_in":["2.2.1-150000.3.58.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openexr","fixed_in":["3.4.15-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"openexr","fixed_in":["3.2.2-160000.11.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-1","3.1.13-2","3.1.5-5","3.1.5-5.1","3.1.5-5.1+hurd.1","3.4.14-0.1","3.4.15+ds-1","3.4.16+ds-1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4","3.5.2+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.16+ds-1"}]}],"versions":["3.1.13-2","3.4.14-0.1","3.4.15+ds-1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-6.54.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-150000.3.58.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-1ubuntu3","2.2.0-7ubuntu1","2.2.0-9ubuntu1","2.2.0-10ubuntu2","2.2.0-10ubuntu2.1","2.2.0-10ubuntu2.2","2.2.0-10ubuntu2.3","2.2.0-10ubuntu2.4","2.2.0-10ubuntu2.6","2.2.0-10ubuntu2.6+esm1","2.2.0-10ubuntu2.6+esm2","2.2.0-10ubuntu2.6+esm3","2.2.0-10ubuntu2.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-11ubuntu1","2.2.0-11.1ubuntu1","2.2.0-11.1ubuntu1.1","2.2.0-11.1ubuntu1.2","2.2.0-11.1ubuntu1.3","2.2.0-11.1ubuntu1.4","2.2.0-11.1ubuntu1.6","2.2.0-11.1ubuntu1.7","2.2.0-11.1ubuntu1.8","2.2.0-11.1ubuntu1.9","2.2.0-11.1ubuntu1.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-4.1ubuntu1","2.3.0-6","2.3.0-6build1","2.3.0-6ubuntu0.1","2.3.0-6ubuntu0.2","2.3.0-6ubuntu0.3","2.3.0-6ubuntu0.5","2.3.0-6ubuntu0.5+esm1","2.3.0-6ubuntu0.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.4-2","2.5.7-1","2.5.7-1ubuntu0.1~esm1","2.5.7-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.5-5.1","3.1.5-5.1build1","3.1.5-5.1build2","3.1.5-5.1build3","3.1.5-5.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2build1","3.4.6+ds-4ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2","3.1.13-2build1","3.1.13-2ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.15-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-160000.11.1"}]}]}],"references":[{"url":"https://github.com/AcademySoftwareFoundation/openexr/issues/2612","tags":["exploit"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/pull/2615"},{"url":"https://github.com/AcademySoftwareFoundation/openexr/pull/2615/changes/70ddecfe82d2566f3776b8ed923939afd47baca2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88384"},{"url":"https://github.com/advisories/GHSA-3cfr-j9gx-46w4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-88384","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624012-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282700","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88384","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264532-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264828-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-88384","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88384","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-88384","description":"OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-24T18:18:33.846Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T13:41:53.237769Z"}],"euvd":[{"id":"EUVD-2026-86273","description":"OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-24T18:18:33Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:56.686358Z"}],"ghsa":[{"id":"GHSA-3cfr-j9gx-46w4","title":"OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially...","description":"OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service.","status":"published","published":"2026-09-24T18:31:27Z","modified":"2026-09-24T21:33:46Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:12:24.174061Z"}],"nvd":[{"id":"CVE-2026-88384","description":"OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service.","status":"published","published":"2026-09-24T17:17:07.907Z","modified":"2026-09-24T21:08:22.573Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:12:51.036099Z"}],"osv":[{"id":"DEBIAN-CVE-2026-88384","description":"OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service.","status":"published","published":"2026-09-24T17:17:07.907Z","modified":"2026-11-07T13:00:09.391918454Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T13:16:37.331514Z"},{"id":"UBUNTU-CVE-2026-88384","description":"OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service.","status":"published","published":"2026-09-24T17:17:00Z","modified":"2026-10-17T13:01:15.778517839Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"openSUSE-SU-2026:11934-1","title":"libIex-3_4-33-3.4.15-1.1 on GA media","description":"These are all security issues fixed in the libIex-3_4-33-3.4.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-30T00:00:00Z","modified":"2026-10-01T11:15:04.410800338Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22013-1","title":"Security update for openexr","description":"This update for openexr fixes the following issue:\n\n- CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file\n  containing an unknown-type attribute with dataSize set to zero is processed (bsc#1282700).\n","status":"published","published":"2026-10-02T15:28:07Z","modified":"2026-10-03T17:23:10.931319683Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24012-1","title":"Security update for openexr","description":"This update for openexr fixes the following issue:\n\n- CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file\n  containing an unknown-type attribute with dataSize set to zero is processed (bsc#1282700).\n","status":"published","published":"2026-10-02T15:26:30Z","modified":"2026-10-09T17:23:09.162309055Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4532-1","title":"Security update for openexr","description":"This update for openexr fixes the following issue:\n\n- CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file\n  containing an unknown-type attribute with dataSize set to zero is processed (bsc#1282700).\n","status":"published","published":"2026-10-06T07:57:59Z","modified":"2026-10-06T18:45:06.186613127Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4828-1","title":"Security update for openexr","description":"This update for openexr fixes the following issue:\n\n- CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file\n  containing an unknown-type attribute with dataSize set to zero is processed (bsc#1282700).\n","status":"published","published":"2026-10-21T11:58:35Z","modified":"2026-10-21T20:02:14.679946735Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}