CVE-2025-48074: academysoftwarefoundation openexr
Vulnerability summary
CVE-2025-48074 is a medium (CVSS 5.5) vulnerability in academysoftwarefoundation openexr. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.6% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 01-08-2025PublishedVulnerability first disclosed.
- 01-08-2025Last modifiedVulnerability information updated.
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · PypiEcosystem advisory · calculated4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
0.00 pp
From 0.26% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundOpenexr
Maturity: poc
Poc
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Academysoftwarefoundation1 product
- openexr≥ 3.3.2, < 3.3.3
Debian1 product
- openexrAll versions (No fix recorded) | < 3.4.6+ds-1
Openexr1 product
- openexr3.3.2
PyPI1 product
- openexr≥ 3.3.2, < 3.3.3
Ubuntu1 product
- openexrAll versions (No fix recorded)
5 vendors · 5 products
References
11 links- github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-x22w-82jp-8rvfX Refsource CONFIRMWEBREPORTExploitVendor Advisory
- pypi.org/project/openexrPACKAGE
