Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenEXR may crash on specially crafted EXR files
published 29 days ago
Summary
The OpenEXR library can stop working if it tries to read an EXR image that contains a hidden attribute with an invalid size. This could cause the application using OpenEXR to freeze or shut down unexpectedly. Apply the latest OpenEXR update from SUSE to prevent the issue.
What to do
- Update suse openexr to version 2.1.0-6.54.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | suse | openexr |
< 2.1.0-6.54.1 Fix: upgrade to 2.1.0-6.54.1
|
Original advisory text
Security update for openexr
This update for openexr fixes the following issue:
- CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file
containing an unknown-type attribute with dataSize set to zero is processed (bsc#1282700).
- CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file
containing an unknown-type attribute with dataSize set to zero is processed (bsc#1282700).
References
- https://www.suse.com/security/cve/CVE-2026-88384 URL
- https://www.suse.com/support/update/announcement/2026/suse-su-20264532-1/ Vendor Advisory
- https://bugzilla.suse.com/1282700 Third Party Advisory
Timeline
Published6 Oct 2026
Updated6 Oct 2026
First seen6 Oct 2026
Sources
SUSE-SU-2026:4532-1 · OSV
Track software like this
Free during beta