CVE catalog
CVE-2025-64183
openexr: CVE-2025-64183
- Severity
- Medium · CVSS 6.2
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.32% · Oct 25, 2026
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, there is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp. The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.) Versions 3.2.5, 3.3.6, and 3.4.3 fix the issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | openexr | sid | 3.4.16+ds-1 | not affected |
| Debian | openexr | forky | 3.4.16+ds-1 | not affected |
| Debian | openexr | trixie | 3.1.13-2 | not affected |
| Debian | openexr | bookworm | 3.1.5-5 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | openexr | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | openexr | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | openexr | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | openexr | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libopenexr-3-1-30]Not affected
Source package: [openexr]
Details (2)
3.1.5-5· amd64 · bookwormNot affected
dsa · openexr · debian · bookworm
3.1.5-5· arm64 · bookwormNot affected
dsa · openexr · debian · bookworm
- [libopenexr-dev]Not affected
Source package: [openexr]
Details (2)
3.1.5-5· amd64 · bookwormNot affected
dsa · openexr · debian · bookworm
3.1.5-5· arm64 · bookwormNot affected
dsa · openexr · debian · bookworm
- [libopenexr-doc]Not affected
Source package: [openexr]
Details (2)
3.1.5-5· all · bookwormNot affected
dsa · openexr · debian · bookworm
3.1.5-5· all · bookwormNot affected
dsa · openexr · debian · bookworm
- [openexr]Not affected
Details (2)
3.1.5-5· amd64 · bookwormNot affected
dsa · openexr · debian · bookworm
3.1.5-5· arm64 · bookwormNot affected
dsa · openexr · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15741-1.json]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-64183]
- [https://security-tracker.debian.org/tracker/CVE-2025-64183]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-64183.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]