CVE-2025-64181 OpenEXR Makes Use of Uninitialized Memory
An attacker can cause a denial of service or undefined behavior in applications using OpenEXR by triggering the use of uninitialized memory during file parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64181?
CVE-2025-64181 is a low-severity vulnerability in Openexr Openexr, published on 10 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.
Weakness: CWE-457
Which versions are affected by CVE-2025-64181?
5 open source packages ship an affected version, including openexr and OpenEXR. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openexr PyPI | From 3.3.0 | 3.3.6, 3.4.3 |
openexr PyPI | From 3.3.0 | 3.3.6 |
openexr PyPI | From 3.4.0 | 3.4.3 |
OpenEXR PyPI | From 3.3.0 | 3.3.6 |
OpenEXR PyPI | From 3.4.0 | 3.4.3 |
Linux distribution packages (3)
openexr SUSE:Linux Enterprise Server 16.0 | All versions | 3.2.2-160000.3.1 |
openexr SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 3.2.2-160000.3.1 |
openexr openSUSE:Leap 16.0 | All versions | 3.2.2-160000.3.1 |
Products include Openexr Openexr.
How do I fix CVE-2025-64181?
Upgrade openexr to a fixed version for your release line: 3.3.6 or 3.4.3.
Is CVE-2025-64181 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64181 exists.
Other vulnerabilities in Openexr Openexr
- CVE-2023-5841 OpenEXR Heap Overflow in Scanline Deep Data Parsing
- CVE-2026-41142 OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
- CVE-2026-42216 OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
- CVE-2017-9111 OpenEXR invalid write
- CVE-2017-9113 Memory corruption in n/a
Sources
Also known as DEBIAN-CVE-2025-64181, ECHO-90ed-3db2-7e6c, GHSA-3h9h-qfvw-98hq, OESA-2025-2710, OESA-2025-2711, OESA-2025-2712 and 7 more.