CVE-2025-64182: OpenEXR Python Adapter RCE Vulnerability

CVE-2025-64182 Overview

CVE-2025-64182 is a memory safety vulnerability in the OpenEXR reference implementation, the EXR image format used across the motion picture industry. The flaw resides in the legacy Python adapter (OpenEXR.InputFile wrapper), specifically within the InputFile.channel() and InputFile.channels() methods. An integer overflow combined with unchecked allocation lets attackers trigger a heap overflow on 32-bit systems or a NULL pointer dereference on 64-bit systems. Exploitation requires processing an attacker-controlled EXR file or a crafted Python object. The defect maps to CWE-120: Buffer Copy without Checking Size of Input.

Critical Impact

Attackers who deliver a malicious EXR file to a Python pipeline using the deprecated wrapper can crash the process and potentially execute arbitrary code on 32-bit builds.

Affected Products

• OpenEXR versions 3.2.0 through 3.2.4
• OpenEXR versions 3.3.0 through 3.3.5
• OpenEXR versions 3.4.0 through 3.4.2

Discovery Timeline

• 2025-11-10 - CVE-2025-64182 published to NVD
• 2025-12-08 - Last updated in NVD database

Technical Details for CVE-2025-64182

Vulnerability Analysis

The defect lives in the deprecated OpenEXR Python wrapper, implemented in PyOpenEXR_old.cpp. The InputFile.channel() and InputFile.channels() methods compute allocation sizes from values controlled by the input file header without bounds validation. When the computed product overflows a 32-bit integer, the wrapper allocates an undersized buffer and then writes pixel data past the allocation boundary, corrupting the heap. On 64-bit platforms the same arithmetic produces a value that the allocator rejects, returning NULL, which the code subsequently dereferences. Both paths result in immediate process termination, and the 32-bit heap overflow path is a plausible vector for arbitrary code execution.

Root Cause

The wrapper trusts size values derived from the EXR file header and from Python objects passed by callers. Channel dimensions and pixel-type sizes are multiplied without overflow checks before being passed to the allocator. The reference code path at src/wrappers/python/PyOpenEXR_old.cpp lines 528–536 illustrates the unchecked multiplication and allocation pattern.

Attack Vector

Exploitation requires local interaction: a victim must open an attacker-supplied EXR file or pass a crafted Python object into the legacy InputFile API. The vulnerability is most relevant in automated rendering and image-processing pipelines that ingest third-party EXR assets. Network exploitation is not part of the documented attack surface, but pipelines that fetch assets from remote storage extend the reachable input set.

No verified proof-of-concept is publicly available. The vulnerability mechanism is documented in the OpenEXR security advisory GHSA-vh63-9mqx-wmjr and the referenced source location in PyOpenEXR_old.cpp.

Detection Methods for CVE-2025-64182

Indicators of Compromise

• Python interpreter crashes or segmentation faults in processes that import the OpenEXR module and call InputFile.channel() or InputFile.channels().
• Heap corruption signatures (glibc malloc aborts, free(): invalid pointer) emitted by Python workers processing EXR assets.
• Unexpected core dumps from render farm nodes, asset ingestion services, or VFX pipeline workers handling third-party EXR files.

Detection Strategies

• Inventory Python environments and identify packages depending on OpenEXR versions 3.2.0–3.2.4, 3.3.0–3.3.5, or 3.4.0–3.4.2 using pip list or SBOM tooling.
• Audit application code for use of the deprecated OpenEXR.InputFile wrapper and flag any remaining call sites for migration.
• Scan EXR assets entering the pipeline for header values that imply pathological channel or pixel-type sizes.

Monitoring Recommendations

• Forward Python worker stderr and crash telemetry to a centralized log store and alert on repeated SIGSEGV exits.
• Track file provenance for EXR inputs and correlate ingestion of externally sourced assets with downstream process crashes.
• Monitor 32-bit build pipelines with greater scrutiny, since these are the systems exposed to the heap overflow path rather than the NULL dereference path.

How to Mitigate CVE-2025-64182

Immediate Actions Required

• Upgrade OpenEXR to version 3.2.5, 3.3.6, or 3.4.3, which contain the patch for InputFile.channel() and InputFile.channels().
• Migrate code away from the deprecated OpenEXR.InputFile wrapper to the supported OpenEXR Python API.
• Quarantine EXR files originating from untrusted sources until pipeline workers are patched.

Patch Information

The OpenEXR maintainers released fixes in versions 3.2.5, 3.3.6, and 3.4.3. Patch details and the corresponding source change are described in the GHSA-vh63-9mqx-wmjr advisory.

Workarounds

• Avoid calling InputFile.channel() and InputFile.channels() from the legacy wrapper until upgrade is complete.
• Restrict EXR processing to 64-bit builds, which fail closed with a NULL dereference rather than a corruptible heap overflow.
• Validate EXR header dimensions and channel counts before passing files to the Python wrapper, rejecting assets with implausible sizes.

# Upgrade to a patched OpenEXR release
pip install --upgrade "openexr>=3.4.3"

# Verify the installed version
python -c "import OpenEXR; print(OpenEXR.__version__)"