Log in Start free

Vulnerability · Published Nov 10, 2025 · Assigned by GitHub_M

CVE-2025-64181OpenEXR Makes Use of Uninitialized Memory

Low 2.0

In plain English

A low-severity security flaw in openexr from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.0Low
Exploit odds (30 days)0.4%top 64.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12openexrno fix listedDEBIAN-CVE-2025-64181
Debian:13openexrno fix listedDEBIAN-CVE-2025-64181
Debian:14openexr3.4.6+ds-1DEBIAN-CVE-2025-64181
PyPIopenexr3.3.6, 3.4.3PYSEC-2026-2843
PyPIopenexr3.3.6GHSA-3h9h-qfvw-98hq
PyPIopenexr3.4.3GHSA-3h9h-qfvw-98hq
Ubuntu:24.04:LTSopenexrno fix listedUBUNTU-CVE-2025-64181
Ubuntu:25.10openexrno fix listedUBUNTU-CVE-2025-64181

Affected products (as reported)

VendorProductVersions
AcademySoftwareFoundation openexr >= 3.3.0, < 3.3.6>= 3.4.0, < 3.4.3

Weakness: CWE-457 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References