CVE-2025-64183

A use-after-free vulnerability has been identified in the Python bindings of the OpenEXR library, where object ownership is incorrectly transferred when image channel data is accessed from Python. When a Python script retrieves the list of channel names or reads pixel data through the affected bindings, internal C++ objects may be freed prematurely while still being referenced by Python, allowing an attacker to trigger a crash by supplying maliciously crafted input to an application that uses the vulnerable bindings.

This vulnerability affects OpenEXR versions 3.2.x and later, where the Python bindings were first introduced. 
Red Hat Enterprise Linux 8, 9, 10, and Red Hat In-Vehicle OS (RHIVOS) ship OpenEXR 3.1.x or earlier, which do not include the Python bindings, and are therefore not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.