CVE-2025-64181 - CVE House
Back to Database
Status published Low CVE-2025-64181

OpenEXR Makes Use of Uninitialized Memory

Vulnerability Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64181

Credits & Attribution

No credits recorded in the NVD database.

References

More from AcademySoftwareFoundation

View All →
CVE-2025-64183
OpenEXR has use after free in PyObject_StealAttrString
Medium 5.5
CVE-2025-64182
OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()
Medium 5.5
CVE-2025-53012
MaterialX's Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion
Medium 5.5
CVE-2025-53011
MaterialX is Vulnerable to NULL Pointer Dereference due to Unchecked implGraphOutput
Low 2
CVE-2025-53010
MaterialX's unchecked nodeGraph->getOutput return is vulnerable to NULL Pointer Dereference
Low 2

Affected Vendor

AcademySoftwareFoundation

View all reports →

Affected Software

openexr
Vulnerable Versions:
>= 3.3.0, < 3.3.6, >= 3.4.0, < 3.4.3

Timeline

Official Publish: November 10th, 2025
Last Modified: November 12th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-457

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.