Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. OpenEXR
  4. ›
  5. CVE-2025-64182

CVE-2025-64182: OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()

April 6, 2026

A memory safety bug in the legacy OpenEXR Python adapter (the deprecated OpenEXR.InputFile wrapper) allow crashes and likely code execution when opening attacker-controlled EXR files or when passing crafted Python objects.

Integer overflow and unchecked allocation in InputFile.channel() and InputFile.channels() can lead to heap overflow (32 bit) or a NULL deref (64 bit).

This bug was found with ZeroPath.

References

  • github.com/AcademySoftwareFoundation/openexr
  • github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp
  • github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-vh63-9mqx-wmjr
  • github.com/advisories/GHSA-vh63-9mqx-wmjr
  • nvd.nist.gov/vuln/detail/CVE-2025-64182

Code Behaviors & Features

Detect and mitigate CVE-2025-64182 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 3.2.0 before 3.2.5, all versions starting from 3.3.0 before 3.3.6, all versions starting from 3.4.0 before 3.4.3

Fixed versions

  • 3.2.5
  • 3.3.6
  • 3.4.3

Solution

Upgrade to versions 3.2.5, 3.3.6, 3.4.3 or above.

Impact 7.8 HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Source file

pypi/OpenEXR/CVE-2025-64182.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 09 May 2026 12:19:59 +0000.