CVE-2025-64181: OpenEXR Makes Use of Uninitialized Memory
While fuzzing openexr_exrcheck_fuzzer, Valgrind reports a conditional branch depending on uninitialized data inside generic_unpack. This indicates a use of uninitialized memory (CWE-457). The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC.
References
- github.com/AcademySoftwareFoundation/openexr
- github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hq
- github.com/advisories/GHSA-3h9h-qfvw-98hq
- github.com/user-attachments/files/23024726/archive0.zip
- github.com/user-attachments/files/23024736/archive1.zip
- github.com/user-attachments/files/23024740/archive2.zip
- github.com/user-attachments/files/23024744/archive3.zip
- github.com/user-attachments/files/23024746/archive4.zip
- nvd.nist.gov/vuln/detail/CVE-2025-64181
Code Behaviors & Features
Detect and mitigate CVE-2025-64181 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →