CVE-2025-64181

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-64181

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

O

penEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.

References
Link Resource
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hq Exploit Vendor Advisory
https://github.com/user-attachments/files/23024726/archive0.zip Broken Link
https://github.com/user-attachments/files/23024736/archive1.zip Broken Link
https://github.com/user-attachments/files/23024740/archive2.zip Broken Link
https://github.com/user-attachments/files/23024744/archive3.zip Broken Link
https://github.com/user-attachments/files/23024746/archive4.zip Broken Link
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hq Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*
cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*
History

08 Dec 2025, 15:59

Type Values Removed Values Added
First Time Openexr openexr
Openexr
References () https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hq - () https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hq - Exploit, Vendor Advisory
References () https://github.com/user-attachments/files/23024726/archive0.zip - () https://github.com/user-attachments/files/23024726/archive0.zip - Broken Link
References () https://github.com/user-attachments/files/23024736/archive1.zip - () https://github.com/user-attachments/files/23024736/archive1.zip - Broken Link
References () https://github.com/user-attachments/files/23024740/archive2.zip - () https://github.com/user-attachments/files/23024740/archive2.zip - Broken Link
References () https://github.com/user-attachments/files/23024744/archive3.zip - () https://github.com/user-attachments/files/23024744/archive3.zip - Broken Link
References () https://github.com/user-attachments/files/23024746/archive4.zip - () https://github.com/user-attachments/files/23024746/archive4.zip - Broken Link
CPE cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
Summary
  • (es) OpenEXR proporciona la especificación y la implementación de referencia del formato de archivo EXR, un formato de almacenamiento de imágenes para la industria cinematográfica. En las versiones 3.3.0 a 3.3.5 y 3.4.0 a 3.4.2, al realizar fuzzing en 'openexr_exrcheck_fuzzer', Valgrind informa una bifurcación condicional que depende de datos no inicializados dentro de 'generic_unpack'. Esto indica un uso de memoria no inicializada. El problema puede resultar en un comportamiento indefinido y/o un posible crash/denegación de servicio. Las versiones 3.3.6 y 3.4.3 solucionan el problema.

12 Nov 2025, 21:15

Type Values Removed Values Added
References () https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hq - () https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hq -

10 Nov 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-11-10 22:15

Updated : 2025-12-08 15:59

NVD link : CVE-2025-64181

Mitre link : CVE-2025-64181

CVE.ORG link : CVE-2025-64181

JSON object : View

Products Affected

openexr

CWE
CWE-457

Use of Uninitialized Variable