CVE-2026-55371: 
Wolfi vulnerability analysis and mitigation

CVE-2026-55371 is a NULL pointer dereference vulnerability in the OpenEXRCore library's exr_attr_set_bytes() function, affecting OpenEXR versions 3.4.0 through 3.4.12. When a caller supplies a positive hint_length value alongside a NULL type_hint pointer, the function allocates a destination buffer and then attempts to copy from the NULL source pointer, causing a deterministic crash and denial of service. The vulnerability was discovered by researcher qiaozhiyi, published as a GitHub Security Advisory (GHSA-xx72-f24p-cf6r) on June 23, 2026, and fixed in version 3.4.13. It carries a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-20 (Improper Input Validation). The public setter exr_attr_set_bytes() in src/lib/OpenEXRCore/part_attr.c validates the top-level exr_attr_bytes_t value pointer but fails to verify that the nested type_hint pointer is non-NULL when hint_length > 0. The helper function exr_attr_bytes_create() in src/lib/OpenEXRCore/bytes.c then allocates a destination type-hint buffer via exr_attr_bytes_init() and subsequently executes memcpy(u->type_hint, NULL, h), triggering a SIGSEGV. The flaw is reachable through the public OpenEXRCore C API; the vulnerable API was introduced in v3.4.0 and was not present in v3.2.9 or v3.3.11. A minimal C proof-of-concept reproducer is publicly available in the advisory (GitHub Advisory).

Successful exploitation results in a deterministic process crash, causing a denial of service for any application that calls exr_attr_set_bytes() with untrusted or insufficiently validated bytes attribute data. There is no confirmed impact on confidentiality or integrity — remote code execution, information disclosure, and memory corruption beyond the NULL-source crash have not been confirmed. The vulnerability affects only the availability of the vulnerable system, with no subsequent system impact (GitHub Advisory).

A public proof-of-concept (PoC) C reproducer is included in the GitHub Security Advisory, demonstrating a deterministic crash via the public OpenEXRCore C API. The EPSS score is 0.0, indicating very low probability of active exploitation in the near term. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to call the affected API with controlled input, limiting the practical attack surface (GitHub Advisory).

1. Identify target: Locate an application that uses OpenEXR versions 3.4.0–3.4.12 and exposes the exr_attr_set_bytes() API to caller-controlled input.
2. Prepare malicious input: Construct an exr_attr_bytes_t struct with hint_length > 0 (e.g., hint_length = 1), a valid data pointer, and type_hint = NULL.
3. Invoke the vulnerable function: Call exr_attr_set_bytes(ctxt, part_index, name, &bytes) with the crafted struct. The function validates the top-level pointer but passes the NULL type_hint unchecked to exr_attr_bytes_create().
4. Trigger crash: exr_attr_bytes_create() calls exr_attr_bytes_init() which allocates a destination buffer for the type hint, then executes memcpy(u->type_hint, NULL, 1), causing a SIGSEGV and crashing the process.
5. Achieve denial of service: The target application crashes deterministically, resulting in a denial of service (GitHub Advisory).

• Process: Unexpected crash or SIGSEGV in any process using OpenEXR 3.4.0–3.4.12, particularly with a stack trace referencing exr_attr_bytes_create(), exr_attr_set_bytes(), or __memcpy_avx_unaligned_erms_rtm().
• Logs: ASAN/UBSAN output containing runtime error: null pointer passed as argument 2 in src/lib/OpenEXRCore/bytes.c:83; AddressSanitizer reports of SEGV in __memcpy_avx_unaligned_erms_rtm.
• File System: Presence of crash dump or core files from applications linked against OpenEXRCore 3.4.x (GitHub Advisory).

Upgrade OpenEXR to version 3.4.13, which fixes the vulnerability by rejecting hint_length > 0 when type_hint == NULL before calling exr_attr_bytes_create(). As a workaround for applications that cannot immediately upgrade, callers of exr_attr_set_bytes() should validate that type_hint is non-NULL whenever hint_length > 0 before invoking the API. Applications that do not use the exr_attr_set_bytes() function or do not expose it to untrusted input are not at risk (GitHub Advisory).

The vulnerability was reported by researcher qiaozhiyi and disclosed via the Academy Software Foundation's GitHub Security Advisory process. The openSUSE security announce mailing list referenced the advisory in a security update notification. No significant broader media coverage or notable community debate has been observed, consistent with the moderate severity and limited exploitation potential of the flaw (GitHub Advisory).