CVE-2025-64182 — Classic Buffer Overflow in Openexr

CWE-120 — Classic Buffer Overflow6 documents5 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 95.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
OpenexrAcademysoftwarefoundation OpenexrDebian Openexr
Timeline
PublishedNov 10
Latest updateApr 6

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, a memory safety bug in the legacy OpenEXR Python adapter (the deprecated OpenEXR.InputFile wrapper) allow crashes and likely code execution when opening attacker-controlled EXR files or when passing crafted Python objects. Integer overflow and unchecked allocation in InputFil…

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages4 packages

▶NVDopenexr/openexr3.2.0 — 3.2.5+2
▶PyPIopenexr/openexr3.2.0 — 3.2.5+2
▶CVEListV5academysoftwarefoundation/openexr>= 3.2.0, < 3.2.5, >= 3.3.0, < 3.3.6, >= 3.4.0, < 3.4.3+2

🔴Vulnerability Details

3
GHSA
OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()↗2026-04-06
▶
OSV
OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()↗2026-04-06
▶
OSV
CVE-2025-64182: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry↗2025-11-10
▶

📋Vendor Advisories

2
Red Hat
openexr: buffer overflow in PyOpenEXR_old's channels() and channel()↗2025-11-10
▶
Debian
CVE-2025-64182: openexr - OpenEXR provides the specification and reference implementation of the EXR file ...↗2025
▶
CVE-2025-64182 — Classic Buffer Overflow in Openexr | cvebase