OpenEXR CVE-2025-12840

Exploitation requires the victim to open an attacker-crafted EXR file (or load a page/asset that causes an application to parse one) using software built on the OpenEXR library; the specific trigger is OpenEXR's failure to validate the length of user-supplied data before copying it into a heap buffer during EXR parsing. Limiting factors: user interaction is mandatory (UI:R) - there is no server-side or network-automatic path - and the vector is local (AV:L), so an attacker cannot reach a victim without getting them to process a malicious file. No authentication or special privileges are required of the attacker (PR:N). Realistic exposure is concentrated in VFX/rendering/image-processing workflows and any application that auto-ingests untrusted .exr files.

This is a genuine but not emergency-grade priority. The CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a classic client-side file-parsing memory-corruption flaw: no privileges needed (PR:N) and low complexity (AC:L), but the vector is Local (AV:L) and requires user interaction (UI:R), meaning the victim must open a malicious EXR file or visit a page that triggers parsing. Note the apparent tension flagged by the description: it labels this 'Remote Code Execution' and references 'remote attackers,' yet the CVSS vector is AV:L - this is consistent with ZDI's standard modeling of file-format bugs, where delivery is remote (download/web) but exploitation is local because it depends on the target opening the content; the attack is not network-reachable or server-side. Corroborating signals point to lower real-world urgency: EPSS is only 0.19% (9th percentile), the CVE is NOT on CISA KEV, and no public exploit code is indicated in the provided data. Impact is high (C:H/I:H/A:H, code execution in the context of the parsing process), so the ceiling is serious, but absence of active exploitation and the user-interaction requirement place this as a standard patch-cycle item rather than an out-of-band emergency - prioritize for software bundling OpenEXR that routinely ingests untrusted .exr files.

An attacker crafts a malicious EXR image with a manipulated length field and delivers it via a website, email attachment, or shared asset. When a user opens the file in an application built on OpenEXR, the parser copies oversized user-supplied data into an undersized heap buffer, corrupting memory and enabling arbitrary code execution in the context of that process. No public exploit code is identified at time of analysis, but the flaw was reported through ZDI (ZDI-25-991) with technical detail.