PyOpenEXR CVE-2025-68514 Heap Buffer Overflow in Deep EXR Parsing

PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow Vulnerability Overview Vulnerability ID: CVE-2025-68514 CVSS v3 base metrics: 5.5 / 10 Description: A meticulously crafted, depth-scanned EXR file can cause the PyOpenEXR wrapper to reuse scalar depth scanline sample arrays allocated for literal channel names (e.g., "left.R"). The depth reader subsequently registers channels with , which does not match the scalar shape ( , 3) allocated for scalar channels like "left.R". Opening the file using the default public Python API ( ) triggers a heap buffer overflow during normal depth sample decoding. Impact: This is a heap buffer overflow/memory corruption issue within the OpenEXR Python bindings. Applications, services, and asset pipelines may accept unused depth EXR files and open them using the default behavior. This can lead to crashes via specially crafted files. The issue arises in the NumPy array selection when the wrapper decodes depth samples into the target layout, leveraging attacker-controlled channel names and sample counts. It reveals uninitialized heap buffer writes and un-sanitized depth calculations in versions and the current main build, resulting from collisions with merged RGB/RGBA group keys. Affected Range Affected Versions: 3.3.0-3.3.12, 3.4.0-3.4.13 Patched Versions: 3.3.13, 3.4.14 Remediation Fixed Versions: 3.3.13, 3.4.14 POC Code Reproduction Steps Verification Output ```bash reproduce.sh stdout target build case rc classification v3.4.13 original control 0 clean v3.4.13 original poc 134 original heap corruption abort v3.4.13 asan control 0 clean v3.4.13 asan poc 134 ASAN heap-buffer-overflow WRITE v3.4.13 ubsan control 0 clean v3.4.13 ubsan poc 134 original heap corruption abort v3.4.13 msan control 1 MSAN import failure (__msan_retval_tls) v3.4.13 msan poc 1 MSAN import failure (__msan_retval_tls) main original control 0 clean main original poc 134 original heap corruption abort main asan control 0 clean main asan poc 134 ASAN heap-buffer-overflow WRITE main ubsan control 0 clean main ubsan poc 134 original heap corruption abort PASS: deep prefixed literal/RGB key-collision heap OOB reproduced on v3.4.13 and main original+ASAN: controls clean. reproduce.sh stderr reproduce.sh: line 12: 284046 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" reproduce.sh: line 12: 284069 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" reproduce.sh: line 12: 284082 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" reproduce.sh: line 12: 284112 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" reproduce.sh: line 12: 284128 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" reproduce.sh: line 12: 284139 Aborted env "$(envarg[8])" timeout --preserve-status 20s python3 "$PY" v3.4.13 original PoC stdout keys ['left'] left.R: left.R, left.R, all HALF. v3.4.13 original PoC stderr malloc(): invalid size (unsorted) timeout: the monitored command dumped core v3.4.13 ASAN control stdout keys ['left'] left.R: left.R, left.R, all HALF. v3.4.13 ASAN control stderr keys ['left'] left.R: left.R, left.R, all HALF. v3.4.13 ASAN PoC stdout keys ['left'] left.R: left.R, left.R, all HALF. v3.4.13 ASAN PoC stderr ==294061==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300005af84 at pc 0x777e09d86b00 bp 0x7fff... WRITE of size 2 at 0x60300005af84 thread T0 #0 0x777e09d86b00 in __asan_memcpy /home/brbzu/openexr/v3.4.13/sources/openexr-3.4.13/src/lib/OpenEXRCore/... #1 0x777e09d8ccaf in __ZN2PyImf16decodeScanLineImplEP16Imf_3_4::DecodeScanLineInputFile:Data:readDataAt(Imf_3_4::DecodeScanLineInputFile, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int

Goal Reached Thanks to every supporter — we hit 100%!

PyOpenEXR CVE-2025-68514 Heap Buffer Overflow in Deep EXR Parsing

More from this source