OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()

Root

Cause CVE-2025-64182 is a memory safety flaw in the deprecated OpenEXR Python adapter (the OpenEXR.InputFile wrapper). The bug resides in InputFile.channel() and InputFile.channels(), where buffer allocation sizes are computed as typeSize * width * height without any bounds checks [1][4]. On 32-bit systems, integer overflow can wrap the product to a small positive size, causing a heap overflow when readPixels writes data into the undersized buffer. On 64-bit systems, the overflow can cause PyBytes_FromStringAndSize to return NULL, leading to a NULL pointer dereference and crash [4].

Exploitation

The vulnerability can be triggered by opening a specially crafted EXR file or by passing crafted Python objects to the legacy adapter [1]. The attacker does not need special privileges; any application using the deprecated OpenEXR.InputFile is at risk. While the public PoC demonstrates a crash with a malicious header, the unsafe allocation in channel() and channels() allows controlled heap overflow under 32-bit execution [4].

Impact

An attacker capable of supplying a malicious EXR file can cause a denial of service via crash or potentially achieve arbitrary code execution due to heap corruption [1]. The exact impact depends on the system architecture and the memory layout at the time of the overflow.

Mitigation

The issue is patched in OpenEXR versions 3.2.5, 3.3.6, and 3.4.3 [1][4]. Users are strongly advised to update to a patched release or migrate away from the deprecated OpenEXR.InputFile wrapper to the supported openexr module.