CVE-2025-64183

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, there is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp. The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.) Versions 3.2.5, 3.3.6, and 3.4.3 fix the issue.

• CWE-416

• https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L109-L115Product
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-57cw-j6vp-2p9mExploit, Vendor Advisory
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-57cw-j6vp-2p9mExploit, Vendor Advisory

Published

Nov 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64178Jellysweep is a cleanup tool for the Jellyfin media server. …8.9
• CVE-2025-64179lakeFS is an open-source tool that transforms object storage…5.3
• CVE-2025-6418A vulnerability was found in code-projects Simple Online Hot…9.8
• CVE-2025-64180Manager-io/Manager is accounting software. In Manager Deskto…10
• CVE-2025-64181OpenEXR provides the specification and reference implementat…7.5
• CVE-2025-64182OpenEXR provides the specification and reference implementat…7.8
• CVE-2025-64184Dosage is a comic strip downloader and archiver. When downlo…8.8
• CVE-2025-64185Open OnDemand is an open-source HPC portal. Prior to version…6.9
• CVE-2025-64186Evervault is a payment security solution. A vulnerability wa…6.5
• CVE-2025-64187OctoPrint provides a web interface for controlling consumer …4.4
• CVE-2025-64188Incorrect Privilege Assignment vulnerability in PenciDesign …9.8
• CVE-2025-64189Improper Neutralization of Input During Web Page Generation …7.1