OpenEXR CVE-2025-12839

Exploitation requires the victim to open or render an attacker-crafted OpenEXR (.exr) file through an application that uses the OpenEXR library for EXR parsing (UI:R); there is no remote network-service exposure. The specific trigger is an EXR file whose user-supplied data length is not validated before being copied into a heap buffer. Limiting factors: user interaction is mandatory, exploitation is local to the process that parses the file (AV:L, scope unchanged), and impact is bounded by the privileges of that process. Risk is highest in environments that automatically ingest or thumbnail untrusted EXR files (render farms, media/asset pipelines, image viewers with auto-preview), and lower where EXR files come only from trusted sources.

Signals are consistent and point to a genuine but NOT emergency-tier issue. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local attack vector requiring user interaction but no privileges, with full confidentiality/integrity/availability impact once triggered - the standard profile for a client-side file-parsing RCE. Note the apparent tension: the description uses the phrase 'remote attackers,' but the vector is correctly AV:L because exploitation requires the victim to locally open or render a malicious EXR file rather than the attacker reaching the code over the network - these are reconcilable (attacker-supplied file delivered remotely, parsed locally), not a true contradiction. Exploitation signals are weak: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit code is referenced - so there is no public exploit identified at time of analysis. The vulnerability was reported privately through Trend Micro's Zero Day Initiative (ZDI-CAN-27947 / ZDI-25-990), which indicates credible, vetted research rather than opportunistic disclosure. Net: this is a real, patch-worthy memory-corruption RCE in a widely-embedded library, but the user-interaction requirement and low EPSS mean it is a routine-priority fix for most environments, elevated only where untrusted EXR files are processed automatically (e.g., render farms, thumbnailers, media pipelines).

An attacker crafts a malicious OpenEXR (.exr) image whose internal length fields trigger a heap-based buffer overflow when parsed, then delivers it via a web page, email attachment, or shared asset. When a victim opens or an application auto-renders the file, the overflow corrupts heap memory and allows code execution in the context of the parsing process. No public proof-of-concept is referenced, and exploitation requires the victim to open/render the attacker-supplied file (UI:R).