Vulnerability · Published Jul 31, 2025 · Assigned by GitHub_M
CVE-2025-48072OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap
Medium 6.8
In plain English
A medium-severity out-of-bounds read in openexr from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | openexr | 3.3.11-r0 | ALPINE-CVE-2025-48072 |
| Alpine:v3.23 | openexr | 3.4.2-r0 | ALPINE-CVE-2025-48072 |
| Alpine:v3.24 | openexr | 3.4.2-r0 | ALPINE-CVE-2025-48072 |
| PyPI | openexr | 3.3.3 | GHSA-4r7w-q3jg-ff43 |
| PyPI | openexr | 3.3.3 | PYSEC-2026-1746 |
| Ubuntu:25.10 | openexr | no fix listed | UBUNTU-CVE-2025-48072 |
| Ubuntu:26.10 | openexr | no fix listed | UBUNTU-CVE-2025-48072 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.3.2, < 3.3.3 |
Weakness: CWE-125 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43 x_refsource_CONFIRM
- https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361 x_refsource_MISC
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3 x_refsource_MISC