CVE-2025-48072: academysoftwarefoundation openexr Out-of-bounds Read
Vulnerability summary
CVE-2025-48072 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in academysoftwarefoundation openexr. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 31-07-2025PublishedVulnerability first disclosed.
- 31-07-2025Last modifiedVulnerability information updated.
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · PypiEcosystem advisory · calculated6.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST6.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
+0.02 pp
From 0.49% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOpenexr
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Academysoftwarefoundation1 product
- openexr≥ 3.3.2, < 3.3.3
Openexr1 product
- openexr3.3.2
PyPI1 product
- openexr≥ 3.3.2, < 3.3.3
Ubuntu1 product
- openexrAll versions (No fix recorded)
4 vendors · 4 products
References
10 links- github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43X Refsource CONFIRMWEBREPORTExploitVendor Advisory
- github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361X Refsource MISCWEBREPORTPatch
- github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3X Refsource MISCWEBREPORTRelease Notes
- pypi.org/project/openexrPACKAGE