Image Processing Vulnerability in OpenEXR by Open Source Vendor

CVE-2025-59733

What is CVE-2025-59733?

A vulnerability has been identified in the OpenEXR image format when decoding files utilizing DWAA or DWAB compression. The issue arises from an assumption in the decoding routine that all image channels utilize the same pixel type and size, specifically the assumption that the first four channels are red, green, blue, and alpha (RGBA). This misalignment can lead to a buffer overflow, particularly when the main color channels are a 4-byte type and there are additional channels of a different type, such as 2-byte EXR_HALF. This overflow can result in memory corruption, which could be leveraged by an attacker to execute arbitrary code. To mitigate this vulnerability, users are advised to upgrade to version 8.0 or later.

References