Description
OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openexr | 3.4.16+ds-1 | — |
| Debian 12 | openexr | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | openexr | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | openexr | No fix yet | — |
| Ubuntu Pro 24.04 LTS | openexr | No fix yet | — |
| Ubuntu Pro 22.04 LTS | openexr | No fix yet | — |
| Ubuntu Pro 20.04 LTS | openexr | No fix yet | — |
| Ubuntu Pro 18.04 LTS | openexr | No fix yet | — |
| Ubuntu Pro 16.04 LTS | openexr | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | openexr | 2.2.1-150000.3.58.1 | SUSE-SU-2026:4828-1 |
| SLES 12 SP5 | openexr | 2.1.0-6.54.1 | SUSE-SU-2026:4532-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | openexr | 3.2.2-160000.11.1 | SUSE-SU-2026:24012-1 |
| SLES 16.0 | openexr | 3.2.2-160000.11.1 | SUSE-SU-2026:24012-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openexr | 3.4.15-1.1 | openSUSE-SU-2026:11934-1 |
| openSUSE Leap 16.0 | openexr | 3.2.2-160000.11.1 | openSUSE-SU-2026:22013-1 |
Advisories 5
- SUSE-SU-2026:4828-1 Security update for openexr SUSE / openSUSE Security Updates · Oct 21, 2026
- SUSE-SU-2026:24012-1 Security update for openexr SUSE / openSUSE Security Updates · Oct 9, 2026
- SUSE-SU-2026:4532-1 Security update for openexr SUSE / openSUSE Security Updates · Oct 6, 2026
- openSUSE-SU-2026:22013-1 Security update for openexr SUSE / openSUSE Security Updates · Oct 3, 2026
- openSUSE-SU-2026:11934-1 libIex-3_4-33-3.4.15-1.1 on GA media SUSE / openSUSE Security Updates · Oct 1, 2026