CVE-2025-59732
Severity CVSS v4.0:
HIGH
Type:
CWE-787
Out-of-bounds Write
Publication date:
06/10/2025
Last modified:
19/10/2025
Description
When decoding an OpenEXR file that uses DWAA or DWAB compression, there&#39;s an implicit assumption that the height and width are divisible by 8.<br />
<br />
If the height or width of the image is not divisible by 8, the copy loops at [0] and [1] will continue to write until the next multiple of 8.<br />
<br />
The buffer td->uncompressed_data is allocated in decode_block based on the precise height and width of the image, so the "rounded-up" multiple of 8 in the copy loop can exceed the buffer bounds, and the write block starting at [2] can corrupt following heap memory.<br />
<br />
<br />
<br />
We recommend upgrading to version 8.0 or beyond.
Impact
Base Score 4.0
8.70
Severity 4.0
HIGH