https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:53:31.916609+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-55371 BELL-CVE-2026-55371 2026-10-03T20:53:31.922861+00:00

Affected: Alpaquita:stream: openexr

 https://cve.radiocsirt.org/vuln/euvd-2026-358965 EUVD-2026-358965 2026-10-03T20:53:31.922906+00:00 EUVD-2026-358965 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55371 fkie_cve-2026-55371 2026-10-03T20:53:31.922921+00:00

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero. When a caller supplies a positive hint_length together with a NULL type_hint, exr_attr_bytes_create() allocates a destination type-hint buffer and then copies from the NULL source pointer, causing a deterministic crash. The flaw is reachable through the public OpenEXRCore C API and results in a denial of service. The issue is fixed in version 3.4.13.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11218-1 openSUSE-SU-2026:11218-1 — libIex-3_4-33-3.4.13-1.1 on GA media 2026-10-03T20:53:31.922951+00:00

libIex-3_4-33-3.4.13-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-55371 UBUNTU-CVE-2026-55371 2026-10-03T20:53:31.922971+00:00

Affected: Ubuntu:Pro:16.04:LTS: openexr, Ubuntu:Pro:18.04:LTS: openexr, Ubuntu:Pro:20.04:LTS: openexr, Ubuntu:Pro:22.04:LTS: openexr, Ubuntu:Pro:24.04:LTS: openexr, Ubuntu:Pro:26.04:LTS: openexr

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero. When a caller supplies a positive hint_length together with a NULL type_hint, exr_attr_bytes_create() allocates a destination type-hint buffer and then copies from the NULL source pointer, causing a deterministic crash. The flaw is reachable through the public OpenEXRCore C API and results in a denial of service. The issue is fixed in version 3.4.13.