CVE-2025-64182
📋 TL;DR
This vulnerability in OpenEXR's deprecated Python adapter allows memory corruption when processing malicious EXR files. Attackers can cause crashes or potentially execute arbitrary code by exploiting integer overflow and unchecked allocation in InputFile.channel() and InputFile.channels() methods. Users of OpenEXR Python bindings in affected versions are at risk.
💻 Affected Systems
- OpenEXR with Python bindings
📦 What is this software?
Openexr by Openexr
Openexr by Openexr
Openexr by Openexr
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Application crashes causing denial of service and potential data corruption
If Mitigated
Limited impact with proper input validation and sandboxing, but still vulnerable to crashes
🎯 Exploit Status
Exploitation requires crafting malicious EXR files or Python objects
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.5, 3.3.6, 3.4.3
Vendor Advisory: https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-vh63-9mqx-wmjr
Restart Required: No
Instructions:
1. Identify OpenEXR version. 2. Upgrade to patched version via package manager or source. 3. Rebuild Python bindings if using source. 4. Test with sample EXR files.
🔧 Temporary Workarounds
Disable deprecated Python adapter
allReplace usage of deprecated OpenEXR.InputFile with modern OpenEXR API
Replace 'import OpenEXR' with 'import OpenEXR3' or use modern bindings
Input validation
allValidate EXR files before processing with OpenEXR
Implement file signature validation and size limits
🧯 If You Can't Patch
- Implement strict input validation for all EXR files
- Sandbox OpenEXR processing in isolated containers or virtual environments
🔍 How to Verify
Check if Vulnerable:
Check OpenEXR version and verify if using deprecated Python bindingsCheck Version:
python -c "import OpenEXR; print(OpenEXR.__version__)" or check system package managerVerify Fix Applied:
Test with known malicious EXR files and verify no crashes occur📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Memory allocation errors in logs
- Unexpected process termination
Network Indicators:
- Unusual EXR file uploads to web applications
- Multiple failed file processing attempts
SIEM Query:
Process termination events from applications using OpenEXR Python bindings🔗 References
- https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L528-L536
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-vh63-9mqx-wmjr
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-vh63-9mqx-wmjr
