CVE-2026-88384

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...

PT-2026-97930

Name of the Vulnerable Software and Affected Versions OpenEXR version 3.4.14 Description A NULL Pointer Dereference occurs in the C++ attribute parsing path. When processing a specially crafted EXR file containing an unknown-type attribute where the dataSize is set to zero, the parser creates an...