CVE-2025-64182

A memory-safety vulnerability has been identified in the Python bindings of OpenEXR, where improper checks on image channels and attribute stealing operations may result in buffer overflow when processing crafted EXR files or Python objects. An attacker supplying a malicious EXR file or crafted Python object could exploit this flaw to trigger a crash in applications that use the vulnerable bindings, potentially leading to denial-of-service.

This vulnerability affects OpenEXR versions 3.2.x and later, where the Python bindings were first introduced. 
Red Hat Enterprise Linux 8, 9, 10, and Red Hat In-Vehicle OS (RHIVOS) ship OpenEXR 3.1.x or earlier, which do not include the affected Python adapter code, and therefore are not affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.