PT-2025-46203 · Openexr · Openexr

Published 2025-11-10 · Updated 2026-04-06 · CVE-2025-64183

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.2.0 through 3.2.4 OpenEXR versions 3.3.0 through 3.3.5 OpenEXR versions 3.4.0 through 3.4.2

Description OpenEXR is an image storage format used in the motion picture industry. A use-after-free condition exists in the PyObject StealAttrString function within pyOpenEXR old.cpp in versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2. The function obtains a new reference using PyObject GetAttrString, immediately decrements it, and returns a pointer. This results in a dangling pointer being passed to APIs like PyLong AsLong and PyFloat AsDouble, leading to a use-after-free. This issue is triggered when reading attributes such as PixelType.v, Box2i, and V2f.

Recommendations OpenEXR version 3.2.5 OpenEXR version 3.3.6 OpenEXR version 3.4.3

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2025-64183

GHSA-57CW-J6VP-2P9M

OPENSUSE-SU-2025:15741-1

Affected Products

Openexr

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64183.json · Exploit
• 🔥 https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-57cw-j6vp-2p9m · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64183 · Security Note
• https://ubuntu.com/security/CVE-2025-64183 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15741-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-64183 · Security Note
• https://osv.dev/vulnerability/GHSA-57cw-j6vp-2p9m · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-64183 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64183 · Vendor Advisory
• https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L109-L115 · Note
• https://github.com/AcademySoftwareFoundation/openexr · Note
• https://twitter.com/CVEnew/status/1987999626947871167 · Twitter Post
• https://suse.com/security/cve/CVE-2025-64182 · Note
• https://suse.com/security/cve/CVE-2025-64183 · Note
• https://suse.com/security/cve/CVE-2025-64181 · Note