CVE-2025-64183
📋 TL;DR
This CVE describes a use-after-free vulnerability in OpenEXR's Python wrapper that occurs when reading EXR image files. Attackers could exploit this to cause crashes or potentially execute arbitrary code. Affected users include anyone processing EXR files with vulnerable OpenEXR versions through Python interfaces.
💻 Affected Systems
- OpenEXR
- Applications using OpenEXR Python bindings
📦 What is this software?
Openexr by Openexr
Openexr by Openexr
Openexr by Openexr
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if an attacker can supply malicious EXR files
Likely Case
Application crashes or denial of service when processing specially crafted EXR files
If Mitigated
Limited to denial of service if memory corruption doesn't lead to code execution
🎯 Exploit Status
Exploitation requires crafting malicious EXR files and triggering Python parsing
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.5, 3.3.6, or 3.4.3
Vendor Advisory: https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-57cw-j6vp-2p9m
Restart Required: Yes
Instructions:
1. Identify current OpenEXR version. 2. Upgrade to patched version via package manager or source compilation. 3. Restart affected applications. 4. Recompile any Python applications using OpenEXR bindings.
🔧 Temporary Workarounds
Disable Python bindings
allRemove or disable Python interface if not required
pip uninstall openexr
Remove Python bindings from system
Input validation
allValidate EXR files before processing with vulnerable versions
🧯 If You Can't Patch
- Isolate systems processing EXR files in sandboxed environments
- Implement strict file upload controls and scanning for EXR files
🔍 How to Verify
Check if Vulnerable:
Check OpenEXR version: python -c "import OpenEXR; print(OpenEXR.__version__)" or check system package versionCheck Version:
python -c "import OpenEXR; print(OpenEXR.__version__)"Verify Fix Applied:
Confirm version is 3.2.5, 3.3.6, or 3.4.3 or higher📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing EXR files
- Memory access violation errors in Python processes
Network Indicators:
- Unusual EXR file uploads to web applications
- Large volumes of EXR file transfers
SIEM Query:
source="application.log" AND ("segmentation fault" OR "access violation") AND "EXR"🔗 References
- https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L109-L115
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-57cw-j6vp-2p9m
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-57cw-j6vp-2p9m
