CVE-2025-64183 OpenEXR has use after free in PyObject_StealAttrString
A use-after-free vulnerability in OpenEXR's Python bindings allows attackers to execute arbitrary code or cause denial of service via crafted EXR files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64183?
CVE-2025-64183 is a medium-severity use after free vulnerability in Openexr Openexr, published on 10 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, there is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp. The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.) Versions 3.2.5, 3.3.6, and 3.4.3 fix the issue.
Weakness: CWE-416
Which versions are affected by CVE-2025-64183?
7 open source packages ship an affected version, including openexr and OpenEXR. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openexr PyPI | From 3.2.0 | 3.2.5, 3.3.6, 3.4.3 |
openexr PyPI | From 3.2.0 | 3.2.5 |
openexr PyPI | From 3.3.0 | 3.3.6 |
openexr PyPI | From 3.4.0 | 3.4.3 |
OpenEXR PyPI | From 3.2.0 | 3.2.5 |
OpenEXR PyPI | From 3.3.0 | 3.3.6 |
1 more packages
OpenEXR PyPI | From 3.4.0 | 3.4.3 |
Products include Openexr Openexr.
How do I fix CVE-2025-64183?
Upgrade openexr to a fixed version for your release line: 3.2.5, 3.3.6 or 3.4.3.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-64183 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64183 exists.
Other vulnerabilities in Openexr Openexr
- CVE-2023-5841 OpenEXR Heap Overflow in Scanline Deep Data Parsing
- CVE-2026-41142 OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
- CVE-2026-42216 OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
- CVE-2017-9111 OpenEXR invalid write
- CVE-2017-9113 Memory corruption in n/a
Sources
Also known as GHSA-57cw-j6vp-2p9m, JLSEC-2026-139, PYSEC-2026-2844.