Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-48072: OpenEXR can be tricked into corrupting memory

CVE-2025-48072 · published 1 year ago

Summary

The OpenEXR image library (version 3.3.2) can miscalculate data locations when opening specially crafted EXR files, leading to memory corruption. This could allow an attacker to take control of the program that processes the image. Upgrade to version 3.3.3 or later to fix the problem.

What to do

Update contributors to the openexr project openexr to version 3.3.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
pip	contributors to the openexr project	openexr	3.3.2 Fix: upgrade to 3.3.3
–	openexr	openexr	3.3.2 `cpe:2.3:a:openexr:openexr:3.3.2:::::::*`
Ubuntu:25.10	canonical	openexr	All versions

Original advisory text

OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.

References

https://github.com/ShielderSec/poc/tree/main/CVE-2025-48072
https://github.com/advisories/GHSA-4r7w-q3jg-ff43
https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-48072 Vendor Advisory
https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c3... Patch
https://ubuntu.com/security/CVE-2025-48072 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-48072 Third Party Advisory
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48072... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

8.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published31 Jul 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-4r7w-q3jg-ff43 · GHSA

CVE-2025-48072 · NVD

UBUNTU-CVE-2025-48072 · OSV

CVE-2025-48072 · OSV

Track software like this

Free during beta