Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-88384 →
DEBIAN-CVE-2026-88384
OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribut...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
openexr
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
openexr
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
openexr
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- advisory security-tracker.debian.org