https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 18:21:20 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0281 certfr-2026-avi-0281 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0281 https://cve.radiocsirt.org/vuln/euvd-2026-260912 EUVD-2026-260912 https://cve.radiocsirt.org/vuln/euvd-2026-260912 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64183 <p>OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, there is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp. The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.) Versions 3.2.5, 3.3.6, and 3.4.3 fix the issue.</p> <p>OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, there is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp. The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.) Versions 3.2.5, 3.3.6, and 3.4.3 fix the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64183 https://cve.radiocsirt.org/vuln/ghsa-57cw-j6vp-2p9m <p><strong>Affected:</strong> PyPI: OpenEXR</p> <p>### Summary There is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp.</p> <p>This bug was found with [ZeroPath](https://zeropath.com/?utm_source=joshua.hu).</p> <p>### Details</p> <p>The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.).</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L109-L115</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L380-L387</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L1258-L1286</p> <p>### PoC</p> <p>```py import OpenEXR, Imath</p> <p># Any small EXR will do - use one from OpenEXR test images or any project file path = &#34;any_small.exr&#34;</p> <p># Property returns a fresh temporary int subclass, so the buggy helper # decrefs it to zero before passing it to PyLong_AsLong =&gt; UAF. class FreshInt(int): def __new__(cls, v): return int.__new__(cls, v) def __del__(self): # stir the heap to make the UAF obvious under PYTHONMALLOC=debug _ = bytearray(1_000_000)</p> <p>class PixelTypeProxy:…</p> <p><strong>Affected:</strong> PyPI: OpenEXR</p> <p>### Summary There is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp.</p> <p>This bug was found with [ZeroPath](https://zeropath.com/?utm_source=joshua.hu).</p> <p>### Details</p> <p>The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.).</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L109-L115</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L380-L387</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L1258-L1286</p> <p>### PoC</p> <p>```py import OpenEXR, Imath</p> <p># Any small EXR will do - use one from OpenEXR test images or any project file path = &#34;any_small.exr&#34;</p> <p># Property returns a fresh temporary int subclass, so the buggy helper # decrefs it to zero before passing it to PyLong_AsLong =&gt; UAF. class FreshInt(int): def __new__(cls, v): return int.__new__(cls, v) def __del__(self): # stir the heap to make the UAF obvious under PYTHONMALLOC=debug _ = bytearray(1_000_000)</p> <p>class PixelTypeProxy:…</p> https://cve.radiocsirt.org/vuln/ghsa-57cw-j6vp-2p9m https://cve.radiocsirt.org/vuln/opensuse-su-2025:15741-1 <p>libIex-3_4-33-3.4.3-1.1 on GA media</p> <p>libIex-3_4-33-3.4.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15741-1 https://cve.radiocsirt.org/vuln/pysec-2026-2844 <p><strong>Affected:</strong> PyPI: openexr</p> <p>### Summary There is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp.</p> <p>This bug was found with [ZeroPath](https://zeropath.com/?utm_source=joshua.hu).</p> <p>### Details</p> <p>The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.).</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L109-L115</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L380-L387</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L1258-L1286</p> <p>### PoC</p> <p>```py import OpenEXR, Imath</p> <p># Any small EXR will do - use one from OpenEXR test images or any project file path = &#34;any_small.exr&#34;</p> <p># Property returns a fresh temporary int subclass, so the buggy helper # decrefs it to zero before passing it to PyLong_AsLong =&gt; UAF. class FreshInt(int): def __new__(cls, v): return int.__new__(cls, v) def __del__(self): # stir the heap to make the UAF obvious under PYTHONMALLOC=debug _ = bytearray(1_000_000)</p> <p>class PixelTypeProxy:…</p> <p><strong>Affected:</strong> PyPI: openexr</p> <p>### Summary There is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp.</p> <p>This bug was found with [ZeroPath](https://zeropath.com/?utm_source=joshua.hu).</p> <p>### Details</p> <p>The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.).</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L109-L115</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L380-L387</p> <p>https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L1258-L1286</p> <p>### PoC</p> <p>```py import OpenEXR, Imath</p> <p># Any small EXR will do - use one from OpenEXR test images or any project file path = &#34;any_small.exr&#34;</p> <p># Property returns a fresh temporary int subclass, so the buggy helper # decrefs it to zero before passing it to PyLong_AsLong =&gt; UAF. class FreshInt(int): def __new__(cls, v): return int.__new__(cls, v) def __del__(self): # stir the heap to make the UAF obvious under PYTHONMALLOC=debug _ = bytearray(1_000_000)</p> <p>class PixelTypeProxy:…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2844 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64183 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: openexr, Ubuntu:18.04:LTS: openexr, Ubuntu:Pro:20.04:LTS: openexr, Ubuntu:Pro:22.04:LTS: openexr, Ubuntu:24.04:LTS: openexr, Ubuntu:25.10: openexr</p> <p>OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, there is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp. The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.) Versions 3.2.5, 3.3.6, and 3.4.3 fix the issue.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: openexr, Ubuntu:18.04:LTS: openexr, Ubuntu:Pro:20.04:LTS: openexr, Ubuntu:Pro:22.04:LTS: openexr, Ubuntu:24.04:LTS: openexr, Ubuntu:25.10: openexr</p> <p>OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, there is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp. The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.) Versions 3.2.5, 3.3.6, and 3.4.3 fix the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64183