Vulnerability · Published Aug 1, 2025 · Assigned by GitHub_M
CVE-2025-48074OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors
Medium 4.6
In plain English
A medium-severity resource allocation without limits in openexr from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | openexr | 3.3.11-r0 | ALPINE-CVE-2025-48074 |
| Alpine:v3.23 | openexr | 3.4.2-r0 | ALPINE-CVE-2025-48074 |
| Alpine:v3.24 | openexr | 3.4.2-r0 | ALPINE-CVE-2025-48074 |
| Debian:12 | openexr | no fix listed | DEBIAN-CVE-2025-48074 |
| Debian:13 | openexr | no fix listed | DEBIAN-CVE-2025-48074 |
| Debian:14 | openexr | 3.4.6+ds-1 | DEBIAN-CVE-2025-48074 |
| PyPI | openexr | 3.3.3 | PYSEC-2026-1749 |
| PyPI | openexr | 3.3.3 | GHSA-x22w-82jp-8rvf |
| Ubuntu:24.04:LTS | openexr | no fix listed | UBUNTU-CVE-2025-48074 |
| Ubuntu:25.10 | openexr | no fix listed | UBUNTU-CVE-2025-48074 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AcademySoftwareFoundation | openexr | >= 3.3.2, < 3.3.3 |
Weakness: CWE-770 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N