CVE-2025-64181 — Use of Uninitialized Variable in Openexr

CWE-457 — Use of Uninitialized Variable6 documents5 sources
Severity
2.0LOWNVD
EPSS
0.1%
top 71.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
OpenexrDebian OpenexrAcademysoftwarefoundation Openexr
Timeline
PublishedNov 10
Latest updateApr 6

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix …

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages5 packages

▶debiandebian/openexr< openexr 3.4.6+ds-1 (forky)
▶NVDopenexr/openexr3.3.0 — 3.3.6+1
▶PyPIopenexr/openexr3.3.0 — 3.3.6+1
▶Debianopenexr/openexr< 3.4.6+ds-1
▶CVEListV5academysoftwarefoundation/openexr>= 3.3.0, < 3.3.6, >= 3.4.0, < 3.4.3+1

🔴Vulnerability Details

3
GHSA
OpenEXR Makes Use of Uninitialized Memory↗2026-04-06
▶
OSV
OpenEXR Makes Use of Uninitialized Memory↗2026-04-06
▶
OSV
CVE-2025-64181: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry↗2025-11-10
▶

📋Vendor Advisories

2
Red Hat
openexr: Use of Uninitialized Memory inside generic_unpack↗2025-11-10
▶
Debian
CVE-2025-64181: openexr - OpenEXR provides the specification and reference implementation of the EXR file ...↗2025
▶
CVE-2025-64181 — Use of Uninitialized Variable | cvebase