Vulnerability · Published Jul 31, 2025 · Assigned by GitHub_M

CVE-2025-48073OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

Medium 4.6

In plain English

A medium-severity null pointer dereference in openexr from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)4.6Medium

Exploit odds (30 days)0.2%top 86.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. This is fixed in version 3.3.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.22	openexr	3.3.11-r0	ALPINE-CVE-2025-48073
Alpine:v3.23	openexr	3.4.2-r0	ALPINE-CVE-2025-48073
Alpine:v3.24	openexr	3.4.2-r0	ALPINE-CVE-2025-48073
PyPI	openexr	3.3.3	GHSA-qhpm-86v7-phmm
PyPI	openexr	3.3.3	PYSEC-2026-1748
Ubuntu:24.04:LTS	openexr	no fix listed	UBUNTU-CVE-2025-48073
Ubuntu:25.10	openexr	no fix listed	UBUNTU-CVE-2025-48073

Affected products (as reported)

Vendor	Product	Versions
AcademySoftwareFoundation	openexr	>= 3.3.2, < 3.3.3

Weakness: CWE-476 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-qhpm-86v7-phmm x_refsource_CONFIRM
https://github.com/ShielderSec/poc/tree/main/CVE-2025-48073 x_refsource_MISC