Every CVE Search/ Get API key

CVE-2025-12840

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

7.8 HighFix available

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27948.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.19%Up 0.2 points since Dec 24, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.8

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27948.

Record
CVE-2025-12840
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2025-204962 7.8

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27948.

Record
EUVD-2025-204962
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-2c96-hx44-wpwr 7.8

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code...

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27948.

Record
GHSA-2c96-hx44-wpwr
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
NVD 7.8

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27948.

Record
CVE-2025-12840
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
OSV 7.8

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27948.

Record
CVE-2025-12840
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
OSVDEBIAN-CVE-2025-12840 7.8

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27948.

Record
DEBIAN-CVE-2025-12840
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVJLSEC-2026-137 7.8

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27948.

Record
JLSEC-2026-137
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2025-12840 7.8

CVE-2025-12840 in openexr - Patched by Root

Root has patched CVE-2025-12840 in the openexr package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2025-12840
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2025-12840 7.8

CVE-2025-12840 in openexr - Patched by Root

Root has patched CVE-2025-12840 in the openexr package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2025-12840
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2025-12840 7.8

CVE-2025-12840 in openexr - Patched by Root

Root has patched CVE-2025-12840 in the openexr package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2025-12840
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-12840 7.8

Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27948.

Record
UBUNTU-CVE-2025-12840
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1775211239 No score

openexr: Fix of 4 CVEs

  • CVE-2025-12495 CVE-2025-12839 CVE-2025-12840: fix heap buffer overflows in the C core decoding pipeline (missing nread validation in exr_read_chunk, missing packed/unpacked size check for uncompressed tiles, missing storage_mode guard in chunk offset computation)
  • CVE-2025-64181: fix use of uninitialized memory caused by incompletely populated scratch buffers (addressed by the same precondition guards in chunk.c and parse_header.c)
Record
CLSA-2026-1775211239
Updated
2026-11-02
OSVopenSUSE-SU-2025:15759-1 No score

libIex-3_4-33-3.4.3-2.1 on GA media

These are all security issues fixed in the libIex-3_4-33-3.4.3-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15759-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:20148-1 No score

Security update for openexr

This update for openexr fixes the following issues:

Changes in openexr:

  • CVE-2025-12495: Fixed a file parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability [bsc#1253714]
  • CVE-2025-12839: Fixed a file parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability [bsc#1253715]
  • CVE-2025-12840: Fixed a file parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability [bsc#1253713]
Record
openSUSE-SU-2025:20148-1
Updated
2026-11-02
OSVSUSE-SU-2025:21189-1 No score

Security update for openexr

This update for openexr fixes the following issues:

Changes in openexr:

  • CVE-2025-12495: Fixed a file parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability [bsc#1253714]
  • CVE-2025-12839: Fixed a file parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability [bsc#1253715]
  • CVE-2025-12840: Fixed a file parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability [bsc#1253713]
Record
SUSE-SU-2025:21189-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openexr
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 3.1.1-3.el9.tuxcare.els2
3.1.1-3.el9.tuxcare.els2
openexr-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 3.1.1-3.el9.tuxcare.els2
3.1.1-3.el9.tuxcare.els2
openexr-libs
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 3.1.1-3.el9.tuxcare.els2
3.1.1-3.el9.tuxcare.els2
openexr
Debian:12
 All versions, plus listed versions
3.1.13-13.1.13-23.1.5-53.1.5-5.13.1.5-5.1+hurd.1
Show 8 moreShow less
3.4.14-0.13.4.15+ds-13.4.16+ds-13.4.6+ds-13.4.6+ds-23.4.6+ds-33.4.6+ds-43.5.2+ds-1
 None known
openexr
Debian:13
 All versions, plus listed versions
3.1.13-23.4.14-0.13.4.15+ds-13.4.16+ds-13.4.6+ds-1
Show 4 moreShow less
3.4.6+ds-23.4.6+ds-33.4.6+ds-43.5.2+ds-1
 None known
openexr
Debian:14
 before 3.4.6+ds-1, plus listed versions
3.1.13-2
3.4.6+ds-1
OpenEXR_jll
Julia
 before 3.4.4+0
3.4.4+0
openexr
Root:Debian:11
 before 2.5.4-2+deb11u1.root.io.13
2.5.4-2+deb11u1.root.io.132.5.4-2+deb11u1.root.io.142.5.4-2+deb11u1.root.io.102.5.4-2+deb11u1.aikido.172.5.4-2+deb11u1.root.io.122.5.4-2+deb11u1.aikido.162.5.4-2+deb11u1.root.io.112.5.4-2+deb11u1.root.io.152.5.4-2+deb11u1.aikido.18
rootio-openexr
Root:Debian:11
 before 2.5.4-2+deb11u1.root.io.13
2.5.4-2+deb11u1.root.io.132.5.4-2+deb11u1.root.io.142.5.4-2+deb11u1.root.io.102.5.4-2+deb11u1.aikido.172.5.4-2+deb11u1.root.io.122.5.4-2+deb11u1.aikido.162.5.4-2+deb11u1.root.io.112.5.4-2+deb11u1.root.io.152.5.4-2+deb11u1.aikido.18
openexr
Root:Debian:12
 before 3.1.5-5.root.io.9
3.1.5-5.root.io.93.1.5-5.root.io.103.1.5-5.root.io.153.1.5-5.root.io.213.1.5-5.root.io.223.1.5-5.root.io.123.1.5-5.root.io.233.1.5-5.root.io.133.1.5-5.root.io.143.1.5-5.root.io.113.1.5-5.root.io.163.1.5-5.root.io.173.1.5-5.root.io.183.1.5-5.root.io.193.1.5-5.root.io.203.1.5-5.aikido.243.1.5-5.aikido.25
Show 10 moreShow less
Affected packages
PackageAffectedFixed
rootio-openexr
Root:Debian:12
 before 3.1.5-5.root.io.9
3.1.5-5.root.io.93.1.5-5.root.io.103.1.5-5.root.io.153.1.5-5.root.io.213.1.5-5.root.io.223.1.5-5.root.io.123.1.5-5.root.io.233.1.5-5.root.io.133.1.5-5.root.io.143.1.5-5.root.io.113.1.5-5.root.io.163.1.5-5.root.io.173.1.5-5.root.io.183.1.5-5.root.io.193.1.5-5.root.io.203.1.5-5.aikido.243.1.5-5.aikido.25
openexr
Root:Debian:13
 before 3.1.13-2.root.io.7
3.1.13-2.root.io.73.1.13-2.root.io.83.1.13-2.aikido.143.1.13-2.root.io.103.1.13-2.root.io.113.1.13-2.root.io.93.1.13-2.root.io.133.1.13-2.root.io.123.1.13-2.aikido.15
rootio-openexr
Root:Debian:13
 before 3.1.13-2.root.io.7
3.1.13-2.root.io.73.1.13-2.root.io.83.1.13-2.aikido.143.1.13-2.root.io.103.1.13-2.root.io.113.1.13-2.root.io.93.1.13-2.root.io.133.1.13-2.root.io.123.1.13-2.aikido.15
openexr
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 3.2.2-160000.4.1
3.2.2-160000.4.1
openexr
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 3.2.2-160000.4.1
3.2.2-160000.4.1
openexr
Ubuntu:25.10
 All versions, plus listed versions
3.1.13-2
 None known
openexr
Ubuntu:26.10
 All versions, plus listed versions
3.1.13-2build13.4.6+ds-4ubuntu3
 None known
openexr
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
3.1.13-23.1.13-2build13.1.13-2ubuntu0.26.04.1~esm1
 None known
openexr
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 3.4.3-2.1
3.4.3-2.1
openexr
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 3.2.2-160000.4.1
3.2.2-160000.4.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-12840 is a high vulnerability (CVSS 7.8) in Academy Software Foundation Openexr, published November 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. Fixed in openexr 3.4.6+ds-1.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open