CVE-2025-48071: academysoftwarefoundation openexr Heap-based Buffer Overflow

Vulnerability summary

CVE-2025-48071 is a high (CVSS 8.4) Heap-based Buffer Overflow vulnerability in academysoftwarefoundation openexr. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 31-07-2025
   PublishedVulnerability first disclosed.
2. 31-07-2025
   Last modifiedVulnerability information updated.

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.2 through 3.3.0, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header. This is fixed in version 3.3.3.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().