p PatchFirst

CVE-2025-48074

CVE-2025-48074 · OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.

CVSS 4.6 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • openexr

    Versions
    • >= 3.3.2, < 3.3.3: Affected

    No fix published

  • openexr Debian:12

    Versions
    • 3.1.13-1
    • 3.1.13-2
    • 3.1.5-5
    • 3.1.5-5.1
    • 3.1.5-5.1+hurd.1
    • 3.4.14-0.1
    • 3.4.6+ds-1
    • 3.4.6+ds-2
    • 3.4.6+ds-3
    • 3.4.6+ds-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openexr Debian:13

    Versions
    • 3.1.13-2
    • 3.4.14-0.1
    • 3.4.6+ds-1
    • 3.4.6+ds-2
    • 3.4.6+ds-3
    • 3.4.6+ds-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openexr Debian:14

    Versions
    • 3.1.13-2
    Affected ranges
    • ECOSYSTEM: < 3.4.6+ds-1

    Update to 3.4.6+ds-1

  • openexr PyPI

    Versions
    • 3.3.2
    Affected ranges
    • ECOSYSTEM: ≥ 3.3.2, < 3.3.3

    Update to 3.3.3

Original sources

Check your server →