OpenEXR CVE-2026-55371

Exploitation requires that the target application uses the OpenEXRCore C API and exposes exr_attr_set_bytes() - directly or indirectly - to user-controlled input such as externally supplied EXR files. The precise trigger is a caller passing hint_length > 0 alongside a NULL type_hint pointer; the crash is deterministic only under this specific parameter combination. The CVSS 4.0 AV:L vector confirms the flaw is reachable only at local system access or API invocation level, not via an independent network path - remote exploitation is possible only if a network-facing service parses user-supplied EXR content using this library. Impact is strictly denial of service (process crash); no code execution, privilege escalation, or data disclosure is possible. Exploitation is limited to OpenEXR versions 3.4.0 through 3.4.12 and does not affect earlier release lines.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) scores 6.9 and constrains exploitation to local system access or direct API invocation, immediately reducing the realistic attacker population compared to a network-reachable flaw. Impact is strictly VA:H (high availability) with no confidentiality or integrity consequences (VC:N/VI:N). The PR:N assignment in a local-vector context likely reflects that the library API itself requires no elevated privileges - any process that loads OpenEXRCore and accepts user-supplied EXR data can reach the flaw - but it does not imply unauthenticated remote exploitation without a network-exposed parsing path. The crash is deterministic, meaning it is highly reliable for DoS but offers no path to code execution. No CISA KEV listing and no confirmed public exploit code further reduce urgency. EPSS data is absent from available intelligence. The SUSE distribution tag suggests the vulnerable library may be packaged broadly across enterprise Linux systems in VFX pipelines, modestly widening the exposure surface beyond direct source builds.

An attacker supplies a crafted EXR file or manipulates API arguments to a VFX rendering engine or media ingest service that uses the OpenEXRCore C API for attribute processing, passing a positive hint_length with a NULL type_hint to exr_attr_set_bytes(). The missing NULL check allows exr_attr_bytes_create() to copy from address zero, immediately crashing the host process. Because the crash is deterministic, a single malformed input reliably terminates the target, making repeated DoS straightforward in any pipeline that does not isolate EXR parsing in a sandboxed subprocess.