Back Linuxsecurity

Fedora 42: USD CVE-2025-14439 Moderate Backport Fix for RCE 2025

Linuxsecurity •LinuxSecurity Advisories • January 3, 2026

Universal Scene Description (USD) is a time-sampled scene description for interchange between graphics applications. Update Information : Backport fix for CVE-2025-14439/GHSA-grjp-54v3-c442

Universal Scene Description (USD) is a time-sampled scene

description for interchange between graphics applications.

Backport fix for CVE-2025-14439/GHSA-grjp-54v3-c442

* Thu Dec 25 2025 Benjamin A. Beasley - 25.02a-5 - Backport fix for CVE-2025-14439/GHSA-grjp-54v3-c442 (fix RHBZ#2422275)

[ 1 ] Bug #2422275 - CVE-2025-14439 usd: OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability [fedora-42] [ 2 ] Bug #2424910 - CVE-2025-12839 usd: OpenEXR: Remote Code Execution via Heap-based Buffer Overflow in EXR File Parsing [fedora-42] [ 3 ] Bug #2424912 - CVE-2025-12840 usd: OpenEXR: Remote Code Execution via EXR file parsing heap-based buffer overflow [fedora-42] [ 4 ] Bug #2424917 - CVE-2025-12495 usd: OpenEXR: Remote Code Execution via malicious EXR file parsing [fedora-42]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-2e7d5d49f2' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora Releases Backport Fix for CVE-2025-14439 RCE Vulnerability Fedora has issued backport fixes for the critical remote code execution vulnerability CVE-2025-14439 affecting Universal Scene Description (USD). The vulnerability impacts users of Fedora 42 and Fedora 43, with updates provided on December 24 and December 25, 2025, respectively. 2 sources 58

Extracted Entities

Companies (1)

Fedora

CVEs (4)

CVE-2025-12495 CVE-2025-12839 CVE-2025-12840 CVE-2025-14439