CVE-2025-48073: academysoftwarefoundation openexr NULL Pointer Dereference
Vulnerability summary
CVE-2025-48073 is a medium (CVSS 6.2) NULL Pointer Dereference vulnerability in academysoftwarefoundation openexr. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.2% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 31-07-2025PublishedVulnerability first disclosed.
- 31-07-2025Last modifiedVulnerability information updated.
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. This is fixed in version 3.3.3.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · PypiEcosystem advisory · calculated4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
0.00 pp
From 0.20% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundOpenexr
Maturity: poc
Poc
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Academysoftwarefoundation1 product
- openexr≥ 3.3.2, < 3.3.3
Openexr1 product
- openexr3.3.2
PyPI1 product
- openexr≥ 3.3.2, < 3.3.3
Ubuntu1 product
- openexrAll versions (No fix recorded)
4 vendors · 4 products
References
8 links- github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-qhpm-86v7-phmmX Refsource CONFIRMWEBREPORTExploitVendor Advisory
- pypi.org/project/openexrPACKAGE