StackRadarChart IndexLive demo

CVE-2025-12839

High

Advisory

Published 23 Dec 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.8; base score, highest
EPSS: 0.002; 9th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 103; of 17,781 indexed, latest versions
Container images: 112; deployed by those charts
Fix available: None; affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 103 of 17,781 indexed charts deploy, on 112 images.

Affected package	Affected versions	Fixed in	Images
openexrdeb	3.1.5-5, 3.1.5-5.1build3, 3.1.13-2, 3.1.13-2build1	no fix listed	112

OSV records: DEBIAN-CVE-2025-12839 UBUNTU-CVE-2025-12839

Charts affected

103 by stars

Chart

Latest

Affected images

Radar Score

tfy-distributortruefoundry

1 of 4 See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2025-12839.

Container image	Digest	Package	Fixed in
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	openexr@3.1.5-5	no fix listed

Open the chart page →

17,323

demo-backendv2fly

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2025-12839.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	openexr@3.1.5-5	no fix listed

Open the chart page →

14,358

maybe-financevicsufer

1 of 3 See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2025-12839.

Container image	Digest	Package	Fixed in
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	openexr@3.1.5-5	no fix listed

Open the chart page →

10,795

Container images carrying it

112 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/opencost/opencost-parquet-exporter :v0.2.1	ce85ef0ce665	openexr@3.1.5-5	no fix listed	1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	openexr@3.1.5-5	no fix listed	1
ghcr.io/wgbh-mla/pbcore-util :pr-6	6e04659a3baa	openexr@3.1.5-5	no fix listed	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	openexr@3.1.5-5	no fix listed	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	openexr@3.1.5-5	no fix listed	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	openexr@3.1.5-5	no fix listed	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	openexr@3.1.5-5	no fix listed	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	openexr@3.1.5-5	no fix listed	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	openexr@3.1.5-5	no fix listed	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	openexr@3.1.5-5	no fix listed	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	openexr@3.1.5-5	no fix listed	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	openexr@3.1.5-5	no fix listed	1