p PatchFirst

CVE-2025-48071

CVE-2025-48071 · OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline Parsing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.2 through 3.3.0, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header. This is fixed in version 3.3.3.

CVSS 8.4 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • openexr

    Versions
    • >= 3.3.0, < 3.3.3: Affected

    No fix published

  • openexr PyPI

    Versions
    • 3.3.0
    • 3.3.1
    • 3.3.2
    Affected ranges
    • ECOSYSTEM: ≥ 3.3.0, < 3.3.3

    Update to 3.3.3

Original sources

Check your server →