https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 13:41:37 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-03140 bdu:2026-03140 https://cve.radiocsirt.org/vuln/bdu:2026-03140 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0281 certfr-2026-avi-0281 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0281 https://cve.radiocsirt.org/vuln/euvd-2026-260673 EUVD-2026-260673 https://cve.radiocsirt.org/vuln/euvd-2026-260673 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64181 <p>OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.</p> <p>OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64181 https://cve.radiocsirt.org/vuln/ghsa-3h9h-qfvw-98hq <p><strong>Affected:</strong> PyPI: OpenEXR</p> <p>### Summary While fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory (CWE-457). The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC.</p> <p>### Details</p> <p>**Environment:** - Tooling: `valgrind --tool=memcheck --track-origins=yes` - Target: `openexr_exrcheck_fuzzer` - OS: Ubuntu 20.04.6 LTS focal x86_64 - openexr version and Git-commit hash: ` openexr 3.4.2 | commit fd657e8a41e157e5841c7cc2e2a5efe094b069a1 (grafted, HEAD -&gt; main, origin/main, origin/HEAD)`</p> <p>Function: `generic_unpack`</p> <p>Possible root cause (based on observed symptoms): The unpacker is branching on bytes in a scratch buffer that were never written because the decode step didn’t fully populate it. - The first use flagged is in `generic_unpack()`. That function reads from the decompressed/expanded pixel buffer to scatter data into the framebuffer. A “conditional jump depends on uninitialised value(s)” means it’s consulting bytes in that buffer before they were written. - Valgrind says the uninitialised value “was created by a heap allocation (malloc)”, not the stack: this matches a per-tile/per-scanline decode scratch buffer allocated in `exr_decoding_run()`.</p> <p>**Valgrind Trace (top frames):** ```bash ==454== Conditional jump or move depends on uninitialised value(s) ==454== at 0x4539BE: generic_unpack (in /out/openexr_exrcheck_fuzzer) ==454== by 0x44B85F: exr_decod…</p> <p><strong>Affected:</strong> PyPI: OpenEXR</p> <p>### Summary While fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory (CWE-457). The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC.</p> <p>### Details</p> <p>**Environment:** - Tooling: `valgrind --tool=memcheck --track-origins=yes` - Target: `openexr_exrcheck_fuzzer` - OS: Ubuntu 20.04.6 LTS focal x86_64 - openexr version and Git-commit hash: ` openexr 3.4.2 | commit fd657e8a41e157e5841c7cc2e2a5efe094b069a1 (grafted, HEAD -&gt; main, origin/main, origin/HEAD)`</p> <p>Function: `generic_unpack`</p> <p>Possible root cause (based on observed symptoms): The unpacker is branching on bytes in a scratch buffer that were never written because the decode step didn’t fully populate it. - The first use flagged is in `generic_unpack()`. That function reads from the decompressed/expanded pixel buffer to scatter data into the framebuffer. A “conditional jump depends on uninitialised value(s)” means it’s consulting bytes in that buffer before they were written. - Valgrind says the uninitialised value “was created by a heap allocation (malloc)”, not the stack: this matches a per-tile/per-scanline decode scratch buffer allocated in `exr_decoding_run()`.</p> <p>**Valgrind Trace (top frames):** ```bash ==454== Conditional jump or move depends on uninitialised value(s) ==454== at 0x4539BE: generic_unpack (in /out/openexr_exrcheck_fuzzer) ==454== by 0x44B85F: exr_decod…</p> https://cve.radiocsirt.org/vuln/ghsa-3h9h-qfvw-98hq https://cve.radiocsirt.org/vuln/oesa-2025-2710 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: OpenEXR</p> <p>OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light &amp;amp;amp; Magic for use in computer imaging applications. Security Fix(es):</p> <p>OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.(CVE-2025-64181)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: OpenEXR</p> <p>OpenEXR is a high dynamic-range (HDR) image file format originally developed by Industrial Light &amp;amp;amp; Magic for use in computer imaging applications. Security Fix(es):</p> <p>OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.(CVE-2025-64181)</p> https://cve.radiocsirt.org/vuln/oesa-2025-2710 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15741-1 <p>libIex-3_4-33-3.4.3-1.1 on GA media</p> <p>libIex-3_4-33-3.4.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15741-1 https://cve.radiocsirt.org/vuln/pysec-2026-2843 <p><strong>Affected:</strong> PyPI: openexr</p> <p>### Summary While fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory (CWE-457). The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC.</p> <p>### Details</p> <p>**Environment:** - Tooling: `valgrind --tool=memcheck --track-origins=yes` - Target: `openexr_exrcheck_fuzzer` - OS: Ubuntu 20.04.6 LTS focal x86_64 - openexr version and Git-commit hash: ` openexr 3.4.2 | commit fd657e8a41e157e5841c7cc2e2a5efe094b069a1 (grafted, HEAD -&gt; main, origin/main, origin/HEAD)`</p> <p>Function: `generic_unpack`</p> <p>Possible root cause (based on observed symptoms): The unpacker is branching on bytes in a scratch buffer that were never written because the decode step didn’t fully populate it. - The first use flagged is in `generic_unpack()`. That function reads from the decompressed/expanded pixel buffer to scatter data into the framebuffer. A “conditional jump depends on uninitialised value(s)” means it’s consulting bytes in that buffer before they were written. - Valgrind says the uninitialised value “was created by a heap allocation (malloc)”, not the stack: this matches a per-tile/per-scanline decode scratch buffer allocated in `exr_decoding_run()`.</p> <p>**Valgrind Trace (top frames):** ```bash ==454== Conditional jump or move depends on uninitialised value(s) ==454== at 0x4539BE: generic_unpack (in /out/openexr_exrcheck_fuzzer) ==454== by 0x44B85F: exr_decod…</p> <p><strong>Affected:</strong> PyPI: openexr</p> <p>### Summary While fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory (CWE-457). The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC.</p> <p>### Details</p> <p>**Environment:** - Tooling: `valgrind --tool=memcheck --track-origins=yes` - Target: `openexr_exrcheck_fuzzer` - OS: Ubuntu 20.04.6 LTS focal x86_64 - openexr version and Git-commit hash: ` openexr 3.4.2 | commit fd657e8a41e157e5841c7cc2e2a5efe094b069a1 (grafted, HEAD -&gt; main, origin/main, origin/HEAD)`</p> <p>Function: `generic_unpack`</p> <p>Possible root cause (based on observed symptoms): The unpacker is branching on bytes in a scratch buffer that were never written because the decode step didn’t fully populate it. - The first use flagged is in `generic_unpack()`. That function reads from the decompressed/expanded pixel buffer to scatter data into the framebuffer. A “conditional jump depends on uninitialised value(s)” means it’s consulting bytes in that buffer before they were written. - Valgrind says the uninitialised value “was created by a heap allocation (malloc)”, not the stack: this matches a per-tile/per-scanline decode scratch buffer allocated in `exr_decoding_run()`.</p> <p>**Valgrind Trace (top frames):** ```bash ==454== Conditional jump or move depends on uninitialised value(s) ==454== at 0x4539BE: generic_unpack (in /out/openexr_exrcheck_fuzzer) ==454== by 0x44B85F: exr_decod…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2843 https://cve.radiocsirt.org/vuln/suse-su-2025:21014-1 <p>Security update for openexr</p> <p>Security update for openexr</p> https://cve.radiocsirt.org/vuln/suse-su-2025:21014-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64181 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: openexr, Ubuntu:25.10: openexr</p> <p>OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: openexr, Ubuntu:25.10: openexr</p> <p>OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64181