CVE-2026-88384: OpenEXR NULL Pointer Dereference DoS Flaw

CVE-2026-88384 Overview

CVE-2026-88384 is a NULL pointer dereference vulnerability in OpenEXR 3.4.14, the open-source high dynamic range image file format library maintained by the Academy Software Foundation. The flaw resides in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to construct an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor then passes this NULL pointer to memcpy() without validating the zero-size condition, triggering undefined behavior and process termination. Successful exploitation results in denial of service for any application that processes untrusted EXR files.

Critical Impact
Processing a malicious EXR file crashes the host application, disrupting image pipelines, rendering workflows, and automated media processing services.

Affected Products

OpenEXR 3.4.14 (C++ reference implementation)
Applications linking against the affected OpenEXR library for EXR file parsing
Media, VFX, and rendering pipelines that ingest untrusted EXR assets

Discovery Timeline

2026-09-24 - CVE-2026-88384 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-88384

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in OpenEXR's attribute deserialization logic. When the parser encounters an attribute whose type it does not recognize, it falls back to constructing an OpaqueAttribute that stores the raw serialized bytes for later re-emission. The constructor allocates a backing buffer sized to the attribute's declared dataSize and copies the input bytes into it with memcpy().

When dataSize is zero, no allocation occurs and the internal packed_data pointer remains NULL. The code path still invokes memcpy(dst, src, 0) with that NULL source pointer. Although the copy length is zero, passing a NULL source to memcpy() is undefined behavior under the C and C++ standards. Compilers increasingly assume non-NULL arguments and may insert checks that terminate the process, producing a reliable denial of service.

Root Cause

The root cause is missing input validation on the attribute dataSize field before the memory copy. The OpaqueAttribute constructor assumes a valid non-NULL packed_data pointer and does not guard the memcpy() call with a zero-length check. The parser also does not reject or short-circuit zero-length unknown attributes earlier in the deserialization flow.

Attack Vector

Exploitation requires local access and user interaction. An attacker crafts an EXR file whose header declares an unknown attribute type with dataSize = 0. When a victim opens the file in any application built against OpenEXR 3.4.14, the parser invokes the vulnerable OpaqueAttribute constructor and the process terminates. The vector is particularly relevant for automated ingestion pipelines, render farms, and asset-conversion services that process files submitted by untrusted users.

Technical details and the proposed fix are available in GitHub Issue #2612 and GitHub Pull Request #2615.

Detection Methods for CVE-2026-88384

Indicators of Compromise

Repeated unexpected crashes of applications or services that parse EXR files, often with signals consistent with NULL pointer access such as SIGSEGV.
EXR files from untrusted sources whose headers contain attributes with unrecognized type strings and a declared dataSize of zero.
Core dumps whose stack trace terminates inside OpaqueAttribute construction or memcpy() called from OpenEXR attribute parsing.

Detection Strategies

Scan EXR assets statically to flag attributes with zero dataSize paired with non-standard type identifiers.
Instrument EXR-processing services with AddressSanitizer or UndefinedBehaviorSanitizer in test environments to catch the undefined memcpy() call before deployment.
Correlate process crash telemetry from file-processing workers against the arrival of new EXR uploads to identify weaponized samples.

Monitoring Recommendations

Monitor crash and restart counts for render workers, thumbnail generators, and VFX pipeline services that handle EXR input.
Alert on anomalous volumes of malformed EXR submissions to upload endpoints.
Collect and retain core dumps from image-processing services to support root-cause analysis of suspected exploitation.

How to Mitigate CVE-2026-88384

Immediate Actions Required

Inventory all applications and build artifacts that link against OpenEXR 3.4.14 and prioritize those exposed to untrusted file input.
Restrict ingestion of EXR files from untrusted sources until a patched build is deployed.
Isolate EXR parsing in sandboxed worker processes so that a crash does not disrupt the parent service.

Patch Information

A fix is proposed upstream in GitHub Pull Request #2615, which adds validation to prevent the NULL pointer from being passed to memcpy(). The specific code changes are documented in the PR change set. Rebuild and redistribute any downstream software that statically links OpenEXR once the patched release is published.

Workarounds

Pre-validate EXR headers with a lightweight parser that rejects attributes whose declared dataSize is zero before passing files to OpenEXR.
Run EXR processing under a process supervisor that automatically restarts crashed workers and quarantines the triggering input for analysis.
Enforce file-size, origin, and user-permission controls on EXR uploads to limit exposure to attacker-controlled content.

bash

# Example: quarantine EXR files with zero-sized unknown attributes before parsing
# Using exrheader to inspect attributes and reject suspicious files
for f in /ingest/*.exr; do
  if exrheader "$f" 2>&1 | grep -Eq 'type .* size 0'; then
    mv "$f" /quarantine/
  fi
done