CVE-2025-48074
published 2025-08-01CVE-2025-48074: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version…
PriorityP420medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.26%
17.4th percentile
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| academysoftwarefoundation | openexr | — | — |
| debian | openexr | < openexr 3.4.6+ds-1 (forky) | openexr 3.4.6+ds-1 (forky) |
| openexr | openexr | — | — |
| openexr | openexr | >= 0 < 3.4.6+ds-1 | 3.4.6+ds-1 |
| openexr | openexr | >= 3.3.2 < 3.3.3 | 3.3.3 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv4.04.6MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa4.6MEDIUM
osv4.6MEDIUM
vendor_debian4.6MEDIUM
vendor_redhat4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-48074: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry
osv·2025-08-01·CVSS 4.6
CVE-2025-48074 [MEDIUM] CVE-2025-48074: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.
GHSA
OpenEXR Out-Of-Memory via Unbounded File Header Values
ghsa·2025-07-31·CVSS 4.6
CVE-2025-48074 [MEDIUM] CWE-770 OpenEXR Out-Of-Memory via Unbounded File Header Values
OpenEXR Out-Of-Memory via Unbounded File Header Values
### Summary
The OpenEXR file format defines many information about the final image inside of the file header, such as the size of data/display window.
The application trusts the value of `dataWindow` size provided in the header of the input file, and performs computations based on this value.
This may result in unintended behaviors, such as excessively large number of iterations and/or huge memory allocations.
### Details
A concrete example of this issue is present in the function `readScanline()` in `ImfCheckFile.cpp` at line 235, that performs a for-loop using the `dataWindow min.y` and `max.y` coordinates that can be arbitrarily large.
```cpp
in.setFrameBuffer (i);
int step = 1;
//
// try reading scanlines. Continue reading
OSV
OpenEXR Out-Of-Memory via Unbounded File Header Values
osv·2025-07-31·CVSS 4.6
CVE-2025-48074 [MEDIUM] OpenEXR Out-Of-Memory via Unbounded File Header Values
OpenEXR Out-Of-Memory via Unbounded File Header Values
### Summary
The OpenEXR file format defines many information about the final image inside of the file header, such as the size of data/display window.
The application trusts the value of `dataWindow` size provided in the header of the input file, and performs computations based on this value.
This may result in unintended behaviors, such as excessively large number of iterations and/or huge memory allocations.
### Details
A concrete example of this issue is present in the function `readScanline()` in `ImfCheckFile.cpp` at line 235, that performs a for-loop using the `dataWindow min.y` and `max.y` coordinates that can be arbitrarily large.
```cpp
in.setFrameBuffer (i);
int step = 1;
//
// try reading scanlines. Continue reading
Red Hat
openexr: OpenEXR memory exhaustion
vendor_redhat·2025-08-01·CVSS 4.6
CVE-2025-48074 [MEDIUM] CWE-770 openexr: OpenEXR memory exhaustion
openexr: OpenEXR memory exhaustion
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.
A memory exhaustion flaw has been discovered in OpenEXR. In affected versions, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product
Debian
CVE-2025-48074: openexr - OpenEXR provides the specification and reference implementation of the EXR file ...
vendor_debian·2025·CVSS 4.6
CVE-2025-48074 [MEDIUM] CVE-2025-48074: openexr - OpenEXR provides the specification and reference implementation of the EXR file ...
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 3.4.6+ds-1)
sid: resolved (fixed in 3.4.6+ds-1)
trixie: open
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-01
Published