CVE-2025-12840CWE-122

CVE-2025-12840

High · published December 24, 2025

CVSS v3.0
7.8
EPSS
0%
Percentile
8.6
In the wild
Unconfirmed
What it is

🚨 A sneaky flaw in how OpenEXR files are parsed could let attackers run wild! 🔥 Think of it like an unsuspecting partygoer who opens a box of chocolates, only to find a little surprise that wasn't meant to be there—it’s delicious until it’s not! That’s how this vulnerability works, with user data being the unwitting chocolate and malicious code as the uninvited guest. An attacker could potentially execute arbitrary code on your system just by luring someone into visiting a malicious page or opening a harmful EXR file. If exploited, this vulnerability could lead to devastating consequences, including unauthorized access to sensitive information or full control over the system.

Put simply

Think of it like an unsuspecting partygoer who opens a box of chocolates, only to find a little surprise that wasn't meant to be there—it’s delicious until it’s not! That’s how this vulnerability works, with user data being the unwitting chocolate and malicious code as the uninvited guest. The vulnerability arises from inadequate validation of the length of user-supplied data when OpenEXR files are parsed, allowing a heap-based buffer overflow. This oversight can be exploited to run arbitrary code in the context of the current process, making it particularly dangerous.

What to do

An attacker could potentially execute arbitrary code on your system just by luring someone into visiting a malicious page or opening a harmful EXR file. If exploited, this vulnerability could lead to devastating consequences, including unauthorized access to sensitive information or full control over the system. To protect yourself, ensure you update to the latest version of OpenEXR as soon as it’s available. Be cautious with untrusted EXR files and consider implementing robust input validation mechanisms to mitigate risks. User awareness training on the dangers of opening unknown files can also be a powerful defense. You’ve got this! By taking these steps, you’ll be well on your way to securing your systems against this vulnerability! 🛡️

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00194 · 8.6th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2025-12-24T03:15Z
Affected products (1)
ProductVersionsFixed in
openexr/openexr< 3.4.33.4.3
References (1)
EPSS history
Timeline
  • 23 DEC 21:41Z
    Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
    cvelistv5