PT-2025-46201 · Openexr+2 · Openexr+2

Published 2025-10-30 · Updated 2026-05-11 · CVE-2025-64181

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.3.0 through 3.3.5 OpenEXR versions 3.4.0 through 3.4.2

Description OpenEXR is an image storage format used in the motion picture industry. A flaw exists due to a conditional branch based on uninitialized data within the generic unpack function. This can lead to undefined behavior, potentially causing a crash or denial of service. The issue was discovered while fuzzing with openexr exrcheck fuzzer.

Recommendations Update to OpenEXR version 3.3.6 or later. Update to OpenEXR version 3.4.3 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-457

Related Identifiers

BDU:2026-03140

CVE-2025-64181

GHSA-3H9H-QFVW-98HQ

OESA-2025-2740

OPENSUSE-SU-2025:15741-1

OPENSUSE-SU-2025:20056-1

SUSE-SU-2025:21014-1

SUSE-SU-2025_21014-1

Affected Products

Debian

Openexr

Suse

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64181.json · Exploit
• 🔥 https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hq · Exploit
• https://bdu.fstec.ru/vul/2026-03140 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15741-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-64181 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-64181 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64181 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-64181 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2740 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-64181 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-64181 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2025-64181 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20056-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64181 · Vendor Advisory