CVE-2025-64181
published 2025-11-10CVE-2025-64181: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.37%
29.6th percentile
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| academysoftwarefoundation | openexr | — | — |
| academysoftwarefoundation | openexr | — | — |
| debian | openexr | < openexr 3.4.6+ds-1 (forky) | openexr 3.4.6+ds-1 (forky) |
| openexr | openexr | >= 0 < 3.4.6+ds-1 | 3.4.6+ds-1 |
| openexr | openexr | >= 3.3.0 < 3.3.6 | 3.3.6 |
| openexr | openexr | >= 3.3.0 < 3.3.6 | 3.3.6 |
| openexr | openexr | >= 3.4.0 < 3.4.3 | 3.4.3 |
| openexr | openexr | >= 3.4.0 < 3.4.3 | 3.4.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.02.0LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv2.0LOW
vendor_debian2.0LOW
vendor_redhat2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openexr: Use of Uninitialized Memory inside generic_unpack
vendor_redhat·2025-11-10·CVSS 2.0
CVE-2025-64181 [LOW] CWE-457 openexr: Use of Uninitialized Memory inside generic_unpack
openexr: Use of Uninitialized Memory inside generic_unpack
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.
A vulnerability has been identified in the generic_unpack function of OpenEXR’s file-handling library, where uninitialized memory is read when processing certain malformed EXR files. An attacker who supplies a specially crafted
Debian
CVE-2025-64181: openexr - OpenEXR provides the specification and reference implementation of the EXR file ...
vendor_debian·2025·CVSS 2.0
CVE-2025-64181 [LOW] CVE-2025-64181: openexr - OpenEXR provides the specification and reference implementation of the EXR file ...
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.
Scope: local
bookworm: open
bullseye: resolved
forky: resolved (fixed in 3.4.6+ds-1)
sid: resolved (fixed in 3.4.6+ds-1)
trixie: open
GHSA
OpenEXR Makes Use of Uninitialized Memory
ghsa·2026-04-06
CVE-2025-64181 [LOW] CWE-457 OpenEXR Makes Use of Uninitialized Memory
OpenEXR Makes Use of Uninitialized Memory
### Summary
While fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory (CWE-457). The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC.
### Details
**Environment:**
- Tooling: `valgrind --tool=memcheck --track-origins=yes`
- Target: `openexr_exrcheck_fuzzer`
- OS: Ubuntu 20.04.6 LTS focal x86_64
- openexr version and Git-commit hash: ` openexr 3.4.2 | commit fd657e8a41e157e5841c7cc2e2a5efe094b069a1 (grafted, HEAD -> main, origin/main, origin/HEAD)`
Function: `generic_unpack`
Possible root cause (based on observed symptoms):
The unpacker is branching on bytes in a scratch buffer that were never w
OSV
OpenEXR Makes Use of Uninitialized Memory
osv·2026-04-06
CVE-2025-64181 [LOW] OpenEXR Makes Use of Uninitialized Memory
OpenEXR Makes Use of Uninitialized Memory
### Summary
While fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory (CWE-457). The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC.
### Details
**Environment:**
- Tooling: `valgrind --tool=memcheck --track-origins=yes`
- Target: `openexr_exrcheck_fuzzer`
- OS: Ubuntu 20.04.6 LTS focal x86_64
- openexr version and Git-commit hash: ` openexr 3.4.2 | commit fd657e8a41e157e5841c7cc2e2a5efe094b069a1 (grafted, HEAD -> main, origin/main, origin/HEAD)`
Function: `generic_unpack`
Possible root cause (based on observed symptoms):
The unpacker is branching on bytes in a scratch buffer that were never w
OSV
CVE-2025-64181: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry
osv·2025-11-10·CVSS 2.0
CVE-2025-64181 [LOW] CVE-2025-64181: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.
No detection rules found.
No public exploits indexed.
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hqhttps://github.com/user-attachments/files/23024726/archive0.ziphttps://github.com/user-attachments/files/23024736/archive1.ziphttps://github.com/user-attachments/files/23024740/archive2.ziphttps://github.com/user-attachments/files/23024744/archive3.ziphttps://github.com/user-attachments/files/23024746/archive4.ziphttps://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hq
2025-11-10
Published