p PatchFirst

CVE-2025-48072

CVE-2025-48072 · OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.

CVSS 6.8 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • openexr

    Versions
    • >= 3.3.2, < 3.3.3: Affected

    No fix published

  • openexr PyPI

    Versions
    • 3.3.2
    Affected ranges
    • ECOSYSTEM: ≥ 3.3.2, < 3.3.3

    Update to 3.3.3

  • openexr Ubuntu:25.10

    Versions
    • 3.1.13-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openexr Ubuntu:26.10

    Versions
    • 3.1.13-2build1
    • 3.4.6+ds-4ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openexr Ubuntu:Pro:26.04:LTS

    Versions
    • 3.1.13-2
    • 3.1.13-2build1
    • 3.1.13-2ubuntu0.26.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →