CVE-2025-48072

Fixed in a distro release EPSS <1%CVSS 6.8

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.

Published 2025-07-31 · CVE record · OSV

Products: AcademySoftwareFoundation openexr

Fixed upstream

Distro releases