CVE-2025-12840: OpenEXR Heap Overflow RCE Vulnerability

CVE-2025-12840 Overview

CVE-2025-12840 is a heap-based buffer overflow vulnerability in Academy Software Foundation OpenEXR, an open-source high dynamic-range image library used widely across visual effects, animation, and scientific imaging workflows. The flaw resides in the EXR file parsing logic, where user-supplied data is copied into a heap buffer without proper length validation. Attackers can exploit the issue by convincing a user to open a malicious EXR file or visit a page that triggers EXR parsing. Successful exploitation leads to arbitrary code execution in the context of the current process. The vulnerability is tracked as ZDI-CAN-27948 and classified under [CWE-122] (Heap-based Buffer Overflow).

Critical Impact
Attackers can execute arbitrary code on systems that parse a malicious EXR file, gaining the privileges of the process handling the image.

Affected Products

Academy Software Foundation OpenEXR library
Applications embedding the openexr library for EXR image parsing
Visual effects, rendering, and imaging pipelines that ingest untrusted EXR files

Discovery Timeline

2025-12-23 - CVE-2025-12840 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12840

Vulnerability Analysis

The vulnerability exists in the OpenEXR EXR file parser. When OpenEXR processes an EXR image, it reads structured data fields whose sizes are derived from values embedded in the file. The parser copies this data into a heap-allocated buffer without validating that the source length fits within the destination allocation. A crafted EXR file can supply oversized data, overflowing the heap buffer and corrupting adjacent memory.

An attacker who controls the overflow contents can influence heap metadata or in-band data structures, redirecting execution flow. Because OpenEXR is embedded in many graphics applications, the resulting code execution runs with the privileges of whichever host process loaded the malicious file. Exploitation requires user interaction such as opening an EXR file or viewing content that triggers parsing.

Root Cause

The root cause is missing bounds checking on length values read from EXR file structures prior to a heap copy operation. The parser trusts attacker-controlled size fields when determining how many bytes to copy, allowing the source data to exceed the destination buffer.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a malicious EXR file through email, file sharing, a web page that auto-loads the image, or a content pipeline that automatically processes untrusted assets. When the target opens or previews the file, the vulnerable parser triggers the heap overflow, enabling arbitrary code execution within the host application.

No verified public proof-of-concept code is available. Technical details are described in the Zero Day Initiative Advisory ZDI-25-991.

Detection Methods for CVE-2025-12840

Indicators of Compromise

Unexpected crashes, segmentation faults, or heap corruption traces in processes that load libopenexr or call into the OpenEXR runtime.
EXR files originating from untrusted sources with abnormally large header or chunk size fields.
Child processes or shell activity spawned from rendering, compositing, or image-viewing applications shortly after opening an EXR asset.

Detection Strategies

Monitor for anomalous process behavior chained from applications that link OpenEXR, such as unexpected network connections or file writes following image load.
Inspect EXR files at email and web gateways using format-aware scanners that flag malformed structural fields.
Alert on memory corruption telemetry, including non-zero exit codes and AddressSanitizer or Windows Error Reporting events from graphics applications.

Monitoring Recommendations

Track installed versions of openexr across endpoints, build agents, and render farms to identify vulnerable hosts.
Log opens of EXR files received from external sources and correlate with subsequent process or network activity.
Centralize endpoint telemetry from creative and rendering workstations to surface exploit attempts that target media parsers.

How to Mitigate CVE-2025-12840

Immediate Actions Required

Inventory all systems and applications that bundle or dynamically link OpenEXR, including third-party graphics tools and render pipelines.
Update OpenEXR to the patched release referenced in the Zero Day Initiative Advisory ZDI-25-991 as soon as it is available.
Block or quarantine EXR files arriving from untrusted external sources until patching is complete.

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-25-991 and the Academy Software Foundation OpenEXR project for the fixed release. Rebuild any internal applications that statically link OpenEXR against the patched library version.

Workarounds

Restrict EXR file handling to trusted internal sources and sandbox parsing in isolated processes or containers.
Disable automatic preview and thumbnail generation for EXR files in file managers and asset management systems.
Apply application allowlisting to prevent unauthorized child processes from spawning under graphics and rendering applications.

bash

# Identify hosts with vulnerable OpenEXR libraries on Linux
find / -name "libOpenEXR*" -o -name "libIlmImf*" 2>/dev/null
ldconfig -p | grep -i openexr

# Check package version (Debian/Ubuntu)
dpkg -l | grep -i openexr

# Check package version (RHEL/Fedora)
rpm -qa | grep -i openexr