Vulnerability · Published Jul 31, 2025 · Assigned by GitHub_M
CVE-2025-48071OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline Parsing
High 8.4
In plain English
A high-severity heap buffer overflow in openexr from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.2 through 3.3.0, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header. This is fixed in version 3.3.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | openexr | 3.3.11-r0 | ALPINE-CVE-2025-48071 |
| Alpine:v3.23 | openexr | 3.4.2-r0 | ALPINE-CVE-2025-48071 |
| Alpine:v3.24 | openexr | 3.4.2-r0 | ALPINE-CVE-2025-48071 |
| PyPI | openexr | 3.3.3 | GHSA-h45x-qhg2-q375 |
| PyPI | openexr | 3.3.3 | PYSEC-2026-1747 |
| Ubuntu:24.04:LTS | openexr | no fix listed | UBUNTU-CVE-2025-48071 |
| Ubuntu:25.10 | openexr | no fix listed | UBUNTU-CVE-2025-48071 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.3.0, < 3.3.3 |
Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-h45x-qhg2-q375 x_refsource_CONFIRM
- https://github.com/AcademySoftwareFoundation/openexr/commit/916cc729e24aa16b86d82813f6e136340ab2876f x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3 x_refsource_MISC