OpenEXR
CVE-2025-12495
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious EXR file to victim
-
DeliveryVictim opens file in OpenEXR-linked app
-
ExploitOversized data copied into heap buffer
-
ExecutionHeap overflow corrupts memory
-
ImpactExecute arbitrary code in process context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or otherwise cause an application to parse an attacker-controlled EXR file (UI:R), so a deployment is only at risk if it links the OpenEXR library and processes untrusted .exr input - e.g. image viewers, DCC/VFX tools, render pipelines, thumbnailers, or conversion services. The flaw is in the EXR length-validation path and does not require any authentication (PR:N) or special configuration, but the Local attack vector (AV:L) means it cannot be triggered purely over the network without a user action. Limiting factors: mandatory user interaction, the need for the target to actually ingest EXR files, and process-scoped impact (S:U) confined to the privileges of the parsing process. |
| Impact | This is a credible but not emergency-tier priority. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 HIGH) correctly models a client-side file-parsing flaw: although unauthenticated (PR:N) and low-complexity (AC:L), the Attack Vector is Local (AV:L) and User Interaction is Required (UI:R), meaning the victim must open or be served a malicious EXR file - this is not a remotely-triggerable server bug despite the advisory title using the word 'remote.' The EPSS score is very low at 0.19% (9th percentile), indicating no statistical signal of mass exploitation, and the CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. No public exploit code is referenced in the provided data. These signals are consistent with each other: a classic ZDI-brokered memory-safety bug (CWE-122 heap overflow) that is exploitable in principle but currently lacks a known weaponized exploit. The SSVC posture would most likely be exploitation=none, automatable=no (user interaction breaks automation), technical impact=total. Net: patch on a normal cadence; prioritize higher only for systems that routinely ingest untrusted EXR files (render farms, asset pipelines, image-conversion services). |
| Exploit ScenarioDerived | An attacker crafts a malicious OpenEXR (.exr) image file with a length field engineered to overflow a heap buffer during parsing, then delivers it via a website, email attachment, or shared asset. When a user opens the file in an application that links OpenEXR (or visits a page that auto-processes it), the overflow corrupts heap memory and can lead to arbitrary code execution in the context of that process. No public proof-of-concept is identified in the provided data, and exploitation requires the victim to actively open the attacker-supplied file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Heap-based buffer overflow in Academy Software Foundation OpenEXR's EXR file parser allows code execution in the context of the current process when a victim opens or parses a crafted .exr file. The flaw stems from missing validation of attacker-supplied length data before it is copied into a heap buffer; the CVSS 3.0/3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) reflects that no credentials are needed but the victim must be induced to process a malicious image. Only deployments that link OpenEXR and ingest untrusted EXR input - image viewers, DCC/VFX tools, render farms, thumbnailers, conversion services - are exposed; no public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low (0.19%, 9th percentile), making this a credible but not emergency-tier patch priority.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to confirm the fixed release with the vendor advisory (https://www.zerodayinitiative.com/advisories/ZDI-25-989/) and upgrade OpenEXR - and every downstream application that bundles it - to a build that includes the EXR length-validation fix; because coverage is transitive, enumerate embedded copies (SDK bundles, vendored third-party directories, container base images) rather than patching only the system package. Where an upgrade cannot be completed immediately, actionable compensating controls are: strip or quarantine EXR processing from untrusted ingress paths, e.g. block .exr attachments and EXR content types at mail and web gateways (trade-off: legitimate VFX asset exchange breaks and must move to an authenticated transfer channel); disable EXR support or the affected thumbnail/preview generators in viewers and asset services (trade-off: loss of EXR preview functionality); and run parsers, converters and thumbnailers inside a container or sandbox with a low-privilege account, no network egress and restrictive seccomp/AppArmor profiles, so a successful heap overflow cannot reach host resources beyond the process (trade-off: added operational overhead and possible pipeline performance loss). Converting untrusted EXR input to a safer intermediate format on a hardened, isolated host before it reaches production tooling also reduces exposure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenEXR is the Academy Software Foundation's reference implementation and library for the high-dynamic-range EXR image format, widely embedded in visual-effects, compositing, rendering and imaging pipelines. The defect is a CWE-122 heap-based buffer overflow: during parsing of EXR file structures, a length value taken from the file is used to size or bound a heap buffer operation without adequate validation, so an oversized or inconsistent length drives a write past the end of a heap allocation, corrupting adjacent heap metadata and objects. The CVSS vector's AV:L with UI:R models the realistic delivery path - the attacker supplies a malicious .exr through a web page, email attachment, asset drop or shared pipeline folder, and the overflow triggers when the victim's application parses it. PR:N indicates no authentication or special configuration is required to reach the vulnerable path, and S:U means the resulting code execution is confined to the privileges of the parsing process rather than escaping to the host. Because the overflow occurs inside a library consumed by many downstream applications, the practical attack surface is defined by which products embed the vulnerable OpenEXR version and accept external EXR input.
Know when Openexr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened by the victim, so AV:L and UI:R; no auth needed (PR:N), low complexity (AC:L), and arbitrary code execution yields high C/I/A within the unchanged process scope.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27946.
Executive ViewAI
OpenEXR, the image-library component embedded in many visual-effects, rendering, and image-conversion tools, contains a heap buffer overflow that can allow a crafted .exr file to execute code on the workstation or server processing it. Leadership should care because teams that open client-supplied or otherwise untrusted EXR assets-VFX artists, render farms, thumbnailers, and conversion services-could face endpoint compromise and data exposure, although no public exploit has been identified and overall exploitation likelihood is currently low.
No vendor-released patch identified at time of analysis. Interim mitigations include isolating EXR parsing in sandboxed or low-privilege containers, blocking untrusted .exr files from email and web ingestion, restricting render-farm and conversion-service input to trusted sources, enforcing file-type validation at ingress, and monitoring the vendor advisory for a fixed release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possib
Out-of-bounds heap write in OpenEXR's CompositeDeepScanLine::readPixels lets a crafted multi-part deep-scanline EXR file
In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp du
OpenEXR versions 3.3.0-3.3.6 and 3.4.0-3.4.4 are vulnerable to a heap buffer overflow in file parsing due to improper in
There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. Rated medium severity (CV
A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.
A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp
A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruct
An issue was discovered in OpenEXR before 2.4.1. Rated medium severity (CVSS 5.5), this vulnerability is no authenticati
An issue was discovered in OpenEXR before 2.4.1. Rated medium severity (CVSS 5.5), this vulnerability is no authenticati
An issue was discovered in OpenEXR before 2.4.1. Rated medium severity (CVSS 5.5), this vulnerability is no authenticati
An issue was discovered in OpenEXR before 2.4.1. Rated medium severity (CVSS 5.5), this vulnerability is no authenticati
GitHub PoC
Exploit-DB