CVE-2026-55371 AcademySoftwareFoundation CVE debrief

Who should care

Defenders responsible for systems and software using OpenEXR should assess exposure and prioritize verification and mitigation. This includes reviewing OpenEXR version usage, upgrading to version 3.4.13 or later if necessary, and monitoring for potential denial of service attacks. Security teams and vulnerability management teams should also review and update affected systems and software to prevent potential attacks. Additionally, operators and platform维护

Why it matters

CVE-2026-55371 is a NULL pointer dereference vulnerability in OpenEXR versions 3.4.0 through 3.4.12, resulting in a denial of service. Defenders should prioritize verification and mitigation.

• Denial of service attacks may be possible
• Verification of OpenEXR version and upgrade to 3.4.13 or later is necessary
• Monitoring for potential attacks is recommended

Technical summary

The vulnerability exists in OpenEXR versions 3.4.0 through 3.4.12 and is caused by a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero. This flaw results in a denial of service and can be mitigated by upgrading to OpenEXR version 3.4.13 or later. Defenders should prioritize verifying and upgrading to OpenEXR version 3.4.13 or later to mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying and upgrading to OpenEXR version 3.4.13 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify OpenEXR version and upgrade to 3.4.13 or later if necessary
• Review and update affected systems and software
• Monitor for potential denial of service attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.