CVE-2025-64181

Affected versions of the OpenEXR package are vulnerable to Use of Uninitialised Memory due to insufficient post-decode validation of scratch buffers allocated during tile and scanline processing. The generic_unpack function in the decoding pipeline reads from a heap-allocated pixel buffer that was never fully populated by the preceding decode step, causing conditional branches to depend on uninitialized values. An attacker who supplies a crafted EXR file can trigger undefined behavior, potentially resulting in a crash and Denial of Service.