OpenEXR has use after free in PyObject_StealAttrString

Vulnerability

Overview

CVE-2025-64183 is a use-after-free vulnerability found in the OpenEXR library, specifically in the legacy Python adapter file pyOpenEXR_old.cpp [1]. The flaw resides in the function PyObject_StealAttrString, which is designed to steal a string attribute from a Python object. However, instead of properly managing reference counts, the function calls PyObject_GetAttrString to obtain a new reference, immediately decrements that reference (decref), and returns the now-dangling pointer [2]. This pointer is then passed to Python C API functions such as PyLong_AsLong or PyFloat_AsDouble, resulting in a read of freed memory [1][2].

Exploitation

Prerequisites

Exploitation is triggered during the parsing of EXR file metadata. The vulnerable code is invoked in multiple locations, including when reading PixelType.v, Box2i, and V2f attributes from a Python object [1][2]. An attacker could craft a malicious EXR file that, when processed by an application using the vulnerable OpenEXR Python bindings, causes the interpreter to dereference a dangling pointer. No authentication is required; the attack vector is local (file parsing) but can be triggered remotely if an application loads user-supplied EXR files [1].

Impact

Successful exploitation results in a use-after-free condition, which can lead to application crashes or potentially arbitrary code execution in the context of the process reading the file [1]. Given that OpenEXR is widely used in visual effects, rendering, and image processing pipelines, this vulnerability poses a risk to production workflows that handle untrusted EXR files [3].

Mitigation

The issue has been released in versions 3.2.5, 3.3.6, and 3.4.3 [1][2]. Users are strongly advised to update their OpenEXR installations. No workarounds have been publicly documented, and this vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.