CVE-2025-64181
Description
A vulnerability has been identified in the generic_unpack function of OpenEXR’s file-handling library, where uninitialized memory is read when processing certain malformed EXR files. An attacker who supplies a specially crafted EXR file to a vulnerable application that uses OpenEXR may trigger undefined behavior. This may cause the application to crash, leak memory, or behave unpredictably when the file is opened or parsed.
Statement
This vulnerability affects all OpenEXR versions beginning with 3.1.0 (https://github.com/AcademySoftwareFoundation/openexr/commit/a04cbf5a48c7a8b6a6dd3b1e2471bde3cd4cb6df), when the new C-based EXR decoding backend was first introduced. Any release that includes this backend inherits the vulnerable generic_unpack implementation and is considered affected.
OpenEXR 1.x (as shipped in Red Hat Enterprise Linux 6 and 7) and OpenEXR 2.x (as shipped in Red Hat Enterprise Linux 8) predate the C-based decoding backend entirely, and therefore are not affected by this issue.
Also, OpenEXR and IlmBase are no longer bundled together. Starting with OpenEXR 3.x, IlmBase was split out into a separate project named Imath. Imath provides math and numerical types (such as half), while OpenEXR contains all EXR image decoding logic. Therefore, vulnerabilities in the EXR decoding backend apply only to OpenEXR ≥3.1.0, not to IlmBase/Imath.
Mitigation
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4 | 7.5 | N/A |
| Attack Vector | Local | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | Low | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability,Integrity,Other
Technical Impact: Other
Initial variables usually contain junk, which can not be trusted for consistency. This can lead to denial of service conditions, or modify control flow in unexpected ways. In some cases, an attacker can "pre-initialize" the variable using previous actions, which might enable code execution. This can cause a race condition if a lock variable check passes when it should not.
Authorization,Other
Technical Impact: Other
Strings that are not initialized are especially dangerous, since many functions expect a null at the end -- and only at the end -- of a string.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
