Hi,

The following vulnerability was published for openexr.

CVE-2026-88384[0]:
| OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++
| attribute parsing path. A specially crafted EXR file containing an
| unknown-type attribute with dataSize set to zero causes the parser
| to create an opaque attribute with a NULL packed_data pointer. The
| OpaqueAttribute constructor passes the NULL pointer to memcpy()
| without validating the zero-size condition, resulting in undefined
| behavior and process termination, leading to denial of service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-88384
https://www.cve.org/CVERecord?id=CVE-2026-88384
[1] https://github.com/AcademySoftwareFoundation/openexr/issues/2612
[2] https://github.com/AcademySoftwareFoundation/openexr/pull/2615
[3] https://github.com/AcademySoftwareFoundation/openexr/commit/e782bcc1ffe1cc9edfaa5dbad4f28e866eaf9bbb

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
openexr, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149061@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sébastien Noel <twolife@debian.org> (supplier of updated openexr package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 19 Oct 2026 10:56:34 +0200
Source: openexr
Architecture: source
Version: 3.4.16+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel@lists.alioth.debian.org>
Changed-By: Sébastien Noel <twolife@debian.org>
Closes: 1136900 1149061
Changes:
 openexr (3.4.16+ds-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream release
   * Backport upstream patch to fix CVE-2026-88384 (Closes: #1149061)
   * Changes libopenexr-3-4-33 Breaks/Replaces in d/control:
     now "libopenexr-3-1-30 (>> 3.4.6)" instead of "<< 3.4.6+ds-3"
     (Closes: #1136900)
Checksums-Sha1:
 64ff161d97f15fd0cf4b404a3840a55a7f2f9e4d 2004 openexr_3.4.16+ds-1.dsc
 dda4322e349b0fb51e2bbaca6aaac7c5721cf9e0 20599088 openexr_3.4.16+ds.orig.tar.xz
 19489b05aee30d0e8c8f2d2d2f9b364e0c3a51ab 20996 openexr_3.4.16+ds-1.debian.tar.xz
 62101bbf835ece4289a68a21835a1a7694b0fd28 7830 openexr_3.4.16+ds-1_amd64.buildinfo
Checksums-Sha256:
 a70938090585da5b1be57e1c5ec4fed8f1c2dc73f29e182e75f528e6b312a32a 2004 openexr_3.4.16+ds-1.dsc
 1ed724eb5bd0ea90fd4083ca2c4440e06d524a3af477dd295e54614ea0e63949 20599088 openexr_3.4.16+ds.orig.tar.xz
 fbad76516a178251b0f4a78b08c9d50cafb0e16c808dff41c3ad813810af1a63 20996 openexr_3.4.16+ds-1.debian.tar.xz
 9ae893eeb97eddb4396862867e9261f02a8013470fb1367b2ec30eac99afd1bf 7830 openexr_3.4.16+ds-1_amd64.buildinfo
Files:
 41fcdfe0e1922a5377eeec0310cf4a8d 2004 graphics optional openexr_3.4.16+ds-1.dsc
 52c3639495783687ebf77184f6272ba3 20599088 graphics optional openexr_3.4.16+ds.orig.tar.xz
 8d18333942b1ef7e9a1fed974bb64a85 20996 graphics optional openexr_3.4.16+ds-1.debian.tar.xz
 718e2ef36ec6307800b232bb38baa4cf 7830 graphics optional openexr_3.4.16+ds-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQFHBAEBCgAxFiEEdlP6my3wO8aMe9FCrKAIuMk0p9QFAmrV4W0THHR3b2xpZmVA
ZGViaWFuLm9yZwAKCRCsoAi4yTSn1EzvCADBp+gjHc+stu/B1ldCZc/Nt2huws0X
8PmB3B5hetQdKdHprLFhSop5KU5m2kX0mQH0bN0SzF4u3ZjXXROb6RGwD/3bOrbZ
oC7ZLuLKi9cD9IfnEB21yV1mkStd+GUFVd+9aYPqxfE+zBINhVIUls5qP7l+svVP
KqXGyi/32CESD1HlXTnnZmp2cvlKLJv8IG6PnBjkYmFyfFyohkK54BI2m7Unx88e
rq7ZQNxvYfA5JBs32Xwu6XL7bPiQBAIZSm6gDGiVbcyF+H/M7+LgNzhhxjD9jAA9
IkSHmvft6IKDzOS226dQ+7l6EJiHZJXVHr/qRGdhenTvIJ8bLMTn6AOU
=rcoV
-----END PGP SIGNATURE-----