CVE-2025-12495 — Heap-based Buffer Overflow in Openexr

CWE-122 — Heap-based Buffer Overflow6 documents6 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 91.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
OpenexrDebian OpenexrAcademy Software Foundation Openexr
Timeline
PublishedDec 23
Latest updateDec 24

Description

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of t…

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/openexr< openexr 3.4.6+ds-1 (forky)
▶NVDopenexr/openexr< 3.4.3
▶Debianopenexr/openexr< 3.4.6+ds-1

🔴Vulnerability Details

2
GHSA
GHSA-vqvv-4v8r-j8mv: Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability↗2025-12-24
▶
OSV
CVE-2025-12495: Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability↗2025-12-23
▶

📋Vendor Advisories

2
Red Hat
OpenEXR: OpenEXR: Remote Code Execution via malicious EXR file parsing↗2025-12-23
▶
Debian
CVE-2025-12495: openexr - Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow ...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-12495 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-12495 — Heap-based Buffer Overflow in Openexr | cvebase