CVE-2025-12839

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12839", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2025-11-06T20:09:10.080Z", "datePublished": "2025-12-23T21:41:37.030Z", "dateUpdated": "2025-12-24T16:04:35.072Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2025-12-23T21:41:37.030Z"}, "title": "Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "descriptions": [{"lang": "en", "value": "Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27947."}], "affected": [{"vendor": "Academy Software Foundation", "product": "OpenEXR", "versions": [{"version": "3.4.0", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-990/", "name": "ZDI-25-990", "tags": ["x_research-advisory"]}], "dateAssigned": "2025-11-06T20:09:10.115Z", "datePublic": "2025-11-11T23:26:14.649Z", "source": {"lang": "en", "value": "Anonymous"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-24T16:04:28.394239Z", "id": "CVE-2025-12839", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-24T16:04:35.072Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12839", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-24T16:04:28.394239Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-24T16:04:32.287Z"}}], "cna": {"title": "Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "source": {"lang": "en", "value": "Anonymous"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Academy Software Foundation", "product": "OpenEXR", "versions": [{"status": "affected", "version": "3.4.0"}], "defaultStatus": "unknown"}], "datePublic": "2025-11-11T23:26:14.649Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-990/", "name": "ZDI-25-990", "tags": ["x_research-advisory"]}], "dateAssigned": "2025-11-06T20:09:10.115Z", "descriptions": [{"lang": "en", "value": "Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27947."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2025-12-23T21:41:37.030Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12839", "state": "PUBLISHED", "dateUpdated": "2025-12-24T16:04:35.072Z", "dateReserved": "2025-11-06T20:09:10.080Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2025-12-23T21:41:37.030Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "OpenEXR", "vendor": "Academy Software Foundation", "versions": [{"status": "affected", "version": "3.4.0"}]}], "source": "zdi-disclosures@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openexr:openexr:*:*:*:*:*:*:*:*", "matchCriteriaId": "A698C88E-D934-4BCC-9811-3D6FEDFC8320", "versionEndExcluding": "3.4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27947."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo y ejecuci\u00f3n remota de c\u00f3digo (RCE) en el an\u00e1lisis de archivos EXR de OpenEXR de Academy Software Foundation. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de OpenEXR de Academy Software Foundation. Se requiere interacci\u00f3n del usuario para exploit esta vulnerabilidad, ya que el objetivo debe visitar una p\u00e1gina maliciosa o abrir un archivo malicioso.\\n\\nEl defecto espec\u00edfico existe dentro del an\u00e1lisis de archivos EXR. El problema se debe a la falta de validaci\u00f3n adecuada de la longitud de los datos suministrados por el usuario antes de copiarlos a un b\u00fafer basado en mont\u00edculo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del proceso actual. Fue ZDI-CAN-27947."}], "id": "CVE-2025-12839", "lastModified": "2026-10-19T22:10:00.130", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12839", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-24T16:04:28.394239Z", "version": "2.0.3"}}]}, "published": "2025-12-23T22:15:44.407", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-990/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{"bugzilla": {"description": "OpenEXR: OpenEXR: Remote Code Execution via Heap-based Buffer Overflow in EXR File Parsing", "id": "2424741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424741"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-122", "details": ["Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\nThe specific flaw exists within the parsing of EXR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27947.", "A flaw was found in OpenEXR. This heap-based buffer overflow vulnerability occurs during the parsing of EXR files due to improper validation of user-supplied data length. A remote attacker could exploit this by tricking a user into opening a specially crafted malicious EXR file. Successful exploitation could lead to arbitrary code execution in the context of the current process."], "mitigation": {"lang": "en:us", "value": "Users should exercise caution when handling untrusted EXR files. Avoid opening EXR files from unknown or suspicious sources. Additionally, consider running applications that process EXR files within a sandboxed environment to limit potential impact in case of exploitation."}, "name": "CVE-2025-12839", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "OpenEXR", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "OpenEXR", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "OpenEXR", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "OpenEXR", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "OpenEXR", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-23T21:41:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-12839\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-12839\nhttps://www.zerodayinitiative.com/advisories/ZDI-25-990/"], "statement": "This vulnerability is rated Important for Red Hat products. Exploitation requires user interaction, where a target must open a specially crafted malicious EXR file.", "threat_severity": "Important"}

{"created": "2025-12-24T11:51:53.163532+00:00", "updated": "2025-12-24T11:51:53.163559+00:00", "vendors": ["openexr", "openexr$PRODUCT$openexr"]}