CVE-2025-64181

A vulnerability has been identified in the generic_unpack function of OpenEXR’s file-handling library, where uninitialized memory is read when processing certain malformed EXR files. An attacker who supplies a specially crafted EXR file to a vulnerable application that uses OpenEXR may trigger undefined behavior. This may cause the application to crash, leak memory, or behave unpredictably when the file is opened or parsed.

This vulnerability affects all OpenEXR versions beginning with 3.1.0 (https://github.com/AcademySoftwareFoundation/openexr/commit/a04cbf5a48c7a8b6a6dd3b1e2471bde3cd4cb6df), when the new C-based EXR decoding backend was first introduced. Any release that includes this backend inherits the vulnerable generic_unpack implementation and is considered affected.

OpenEXR 1.x (as shipped in Red Hat Enterprise Linux 6 and 7) and OpenEXR 2.x (as shipped in Red Hat Enterprise Linux 8) predate the C-based decoding backend entirely, and therefore are not affected by this issue.

Also, OpenEXR and IlmBase are no longer bundled together. Starting with OpenEXR 3.x, IlmBase was split out into a separate project named Imath. Imath provides math and numerical types (such as half), while OpenEXR contains all EXR image decoding logic. Therefore, vulnerabilities in the EXR decoding backend apply only to OpenEXR ≥3.1.0, not to IlmBase/Imath.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.