CVE-2025-12495: OpenEXR Heap Overflow RCE Vulnerability

CVE-2025-12495 Overview

CVE-2025-12495 is a heap-based buffer overflow vulnerability in Academy Software Foundation OpenEXR, the widely used high dynamic-range image library maintained under the ASWF. The flaw resides in the EXR file parser, which fails to validate the length of user-supplied data before copying it into a heap-allocated buffer. Attackers can trigger the condition by enticing a user to open a crafted EXR file or visit a page that renders one. Successful exploitation allows arbitrary code execution in the context of the current process. The issue was reported through the Zero Day Initiative as ZDI-CAN-27946 and published in the Zero Day Initiative Advisory ZDI-25-989.

Critical Impact
Attackers can achieve arbitrary code execution by delivering a malicious EXR file to any application that uses OpenEXR for image decoding.

Affected Products

Academy Software Foundation OpenEXR (openexr:openexr)
Applications and pipelines that link against vulnerable OpenEXR builds for EXR image decoding
Visual effects, rendering, and image processing tools that integrate the OpenEXR library

Discovery Timeline

2025-12-23 - CVE-2025-12495 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12495

Vulnerability Analysis

The vulnerability is classified as a heap-based buffer overflow under [CWE-122]. It is triggered while parsing untrusted EXR image data, a multi-channel HDR format used across film, animation, and scientific imaging workflows. Because OpenEXR is embedded in many downstream applications, a single crafted image can compromise any process that decodes it. Exploitation requires user interaction such as opening the file or loading a page that processes the image. Successful exploitation yields code execution at the privilege level of the host process, which often runs interactively and can serve as a foothold for further activity.

Root Cause

The parser copies attacker-controlled bytes from the EXR file into a heap buffer without first validating that the length of the input is within the bounds of the destination allocation. When the source data exceeds the expected size, the copy operation overruns the adjacent heap memory. Adjacent heap metadata and object pointers can then be corrupted, enabling control-flow hijack primitives.

Attack Vector

The attack vector is local in the sense that the malicious EXR must be processed by the victim's machine, but delivery is straightforward through email attachments, file shares, web content, or asset pipelines. The vulnerability manifests in the EXR parsing code path; consult the Zero Day Initiative Advisory ZDI-25-989 for technical details. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2025-12495

Indicators of Compromise

Unexpected crashes or memory corruption signatures in processes that load libOpenEXR or OpenEXR.dll when handling image assets
EXR files arriving through email, web downloads, or external asset shares from untrusted sources
Child processes spawned by image viewers, renderers, or DCC tools immediately after opening an EXR file

Detection Strategies

Inventory all applications and pipelines linking OpenEXR and correlate process telemetry with EXR file open events
Hunt for anomalous shell, scripting, or network-connection child processes launched from graphics and content creation applications
Inspect EXR files entering the environment for malformed headers or oversized attribute lengths inconsistent with the OpenEXR specification

Monitoring Recommendations

Enable behavioral process monitoring on workstations used by VFX, rendering, and design teams where EXR processing is routine
Log file write and read operations against EXR assets in shared production storage to support post-incident triage
Alert on crashes or exception events in image-processing binaries that may indicate exploitation attempts

How to Mitigate CVE-2025-12495

Immediate Actions Required

Upgrade OpenEXR to the latest patched release once the fix referenced in ZDI-25-989 is available from the upstream project
Rebuild and redistribute any in-house tools or container images that statically link OpenEXR
Restrict opening EXR files from untrusted senders or sources until patches are deployed

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-25-989 and the OpenEXR project release notes for the patched version. Downstream vendors that bundle OpenEXR should be tracked separately, as fixed versions may lag the upstream library.

Workarounds

Process untrusted EXR files only inside sandboxed or isolated environments such as dedicated VMs or containers
Apply application allow-listing to prevent unexpected child processes from spawning out of image-handling tools
Strip or pre-validate EXR files at the perimeter using trusted decoders before allowing them into production pipelines

bash

# Verify installed OpenEXR version on Linux systems
pkg-config --modversion OpenEXR
ldconfig -p | grep -i openexr

# Identify processes currently loading the OpenEXR library
lsof 2>/dev/null | grep -i openexr