CVE-2025-64181 | BDVDB-2026-301330 Detail
AcademySoftwareFoundationopenexr
Description#
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.
Impact#
Per CVSS v4.0: confidentiality impact none, integrity impact none, availability impact low. Attack vector: local.
Weaknesses#
- CWE-457 Use of Uninitialized Variable
References#
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hq
- https://github.com/user-attachments/files/23024726/archive0.zip
- https://github.com/user-attachments/files/23024736/archive1.zip
- https://github.com/user-attachments/files/23024740/archive2.zip
- https://github.com/user-attachments/files/23024744/archive3.zip
- https://github.com/user-attachments/files/23024746/archive4.zip
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.