{"id":"CVE-2025-48074","aliases":["ALPINE-CVE-2025-48074","DEBIAN-CVE-2025-48074","EUVD-2025-23375","GHSA-x22w-82jp-8rvf","PYSEC-2026-1749","ROOT-OS-DEBIAN-11-CVE-2025-48074","ROOT-OS-DEBIAN-12-CVE-2025-48074","ROOT-OS-DEBIAN-13-CVE-2025-48074","UBUNTU-CVE-2025-48074","openSUSE-SU-2025:15415-1"],"status":"published","title":"OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.","severity":{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00296,"percentile":0.22428,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2025-07-31T19:23:18Z","modified":"2026-11-03T06:32:15Z","fixes":[{"ecosystem":"PyPI","package":"openexr","fixed_in":["3.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.22","package":"openexr","fixed_in":["3.3.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openexr","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openexr","fixed_in":["3.4.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openexr","fixed_in":["3.4.6+ds-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"openexr","fixed_in":["2.5.4-2+deb11u1.root.io.8","2.5.4-2+deb11u1.root.io.4","2.5.4-2+deb11u1.root.io.6","2.5.4-2+deb11u1.root.io.7","2.5.4-2+deb11u1.root.io.13","2.5.4-2+deb11u1.root.io.2","2.5.4-2+deb11u1.root.io.3","2.5.4-2+deb11u1.root.io.14","2.5.4-2+deb11u1.root.io.5","2.5.4-2+deb11u1.root.io.10","2.5.4-2+deb11u1.aikido.17","2.5.4-2+deb11u1.root.io.9","2.5.4-2+deb11u1.root.io.12","2.5.4-2+deb11u1.aikido.16","2.5.4-2+deb11u1.root.io.11","2.5.4-2+deb11u1.root.io.15","2.5.4-2+deb11u1.aikido.18"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-openexr","fixed_in":["2.5.4-2+deb11u1.root.io.8","2.5.4-2+deb11u1.root.io.4","2.5.4-2+deb11u1.root.io.6","2.5.4-2+deb11u1.root.io.7","2.5.4-2+deb11u1.root.io.13","2.5.4-2+deb11u1.root.io.2","2.5.4-2+deb11u1.root.io.3","2.5.4-2+deb11u1.root.io.14","2.5.4-2+deb11u1.root.io.5","2.5.4-2+deb11u1.root.io.10","2.5.4-2+deb11u1.aikido.17","2.5.4-2+deb11u1.root.io.9","2.5.4-2+deb11u1.root.io.12","2.5.4-2+deb11u1.aikido.16","2.5.4-2+deb11u1.root.io.11","2.5.4-2+deb11u1.root.io.15","2.5.4-2+deb11u1.aikido.18"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"openexr","fixed_in":["3.1.5-5.root.io.8","3.1.5-5.root.io.9","3.1.5-5.root.io.10","3.1.5-5.root.io.7","3.1.5-5.root.io.3","3.1.5-5.root.io.5","3.1.5-5.root.io.4","3.1.5-5.root.io.15","3.1.5-5.root.io.6","3.1.5-5.root.io.2","3.1.5-5.root.io.21","3.1.5-5.root.io.22","3.1.5-5.root.io.12","3.1.5-5.root.io.23","3.1.5-5.root.io.13","3.1.5-5.root.io.14","3.1.5-5.root.io.11","3.1.5-5.root.io.16","3.1.5-5.root.io.17","3.1.5-5.root.io.18","3.1.5-5.root.io.19","3.1.5-5.root.io.20","3.1.5-5.aikido.24","3.1.5-5.aikido.25"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-openexr","fixed_in":["3.1.5-5.root.io.8","3.1.5-5.root.io.9","3.1.5-5.root.io.10","3.1.5-5.root.io.7","3.1.5-5.root.io.3","3.1.5-5.root.io.5","3.1.5-5.root.io.4","3.1.5-5.root.io.15","3.1.5-5.root.io.6","3.1.5-5.root.io.2","3.1.5-5.root.io.21","3.1.5-5.root.io.22","3.1.5-5.root.io.12","3.1.5-5.root.io.23","3.1.5-5.root.io.13","3.1.5-5.root.io.14","3.1.5-5.root.io.11","3.1.5-5.root.io.16","3.1.5-5.root.io.17","3.1.5-5.root.io.18","3.1.5-5.root.io.19","3.1.5-5.root.io.20","3.1.5-5.aikido.24","3.1.5-5.aikido.25"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"openexr","fixed_in":["3.1.13-2.root.io.1","3.1.13-2.root.io.2","3.1.13-2.root.io.3","3.1.13-2.root.io.4","3.1.13-2.root.io.6","3.1.13-2.root.io.7","3.1.13-2.root.io.5","3.1.13-2.root.io.8","3.1.13-2.aikido.14","3.1.13-2.root.io.10","3.1.13-2.root.io.11","3.1.13-2.root.io.9","3.1.13-2.root.io.13","3.1.13-2.root.io.12","3.1.13-2.aikido.15"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-openexr","fixed_in":["3.1.13-2.root.io.1","3.1.13-2.root.io.2","3.1.13-2.root.io.3","3.1.13-2.root.io.4","3.1.13-2.root.io.6","3.1.13-2.root.io.7","3.1.13-2.root.io.5","3.1.13-2.root.io.8","3.1.13-2.aikido.14","3.1.13-2.root.io.10","3.1.13-2.root.io.11","3.1.13-2.root.io.9","3.1.13-2.root.io.13","3.1.13-2.root.io.12","3.1.13-2.aikido.15"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.2"},{"last_affected":"3.3.2"},{"fixed":"3.3.3"}]}],"versions":["3.3.2"]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-1","3.1.13-2","3.1.5-5","3.1.5-5.1","3.1.5-5.1+hurd.1","3.4.14-0.1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4"]},{"source":"osv","ecosystem":"Debian:13","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.13-2","3.4.14-0.1","3.4.6+ds-1","3.4.6+ds-2","3.4.6+ds-3","3.4.6+ds-4"]},{"source":"osv","ecosystem":"Debian:14","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.6+ds-1"}]}],"versions":["3.1.13-2"]},{"source":"osv","ecosystem":"PyPI","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.2"},{"fixed":"3.3.3"}]}],"versions":["3.3.2"]},{"source":"osv","ecosystem":"PyPI","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.2"},{"fixed":"3.3.3"}]}],"versions":["3.3.2"]},{"source":"osv","ecosystem":"Root:Debian:11","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2+deb11u1.root.io.8"},{"fixed":"2.5.4-2+deb11u1.root.io.4"},{"fixed":"2.5.4-2+deb11u1.root.io.6"},{"fixed":"2.5.4-2+deb11u1.root.io.7"},{"fixed":"2.5.4-2+deb11u1.root.io.13"},{"fixed":"2.5.4-2+deb11u1.root.io.2"},{"fixed":"2.5.4-2+deb11u1.root.io.3"},{"fixed":"2.5.4-2+deb11u1.root.io.14"},{"fixed":"2.5.4-2+deb11u1.root.io.5"},{"fixed":"2.5.4-2+deb11u1.root.io.10"},{"fixed":"2.5.4-2+deb11u1.aikido.17"},{"fixed":"2.5.4-2+deb11u1.root.io.9"},{"fixed":"2.5.4-2+deb11u1.root.io.12"},{"fixed":"2.5.4-2+deb11u1.aikido.16"},{"fixed":"2.5.4-2+deb11u1.root.io.11"},{"fixed":"2.5.4-2+deb11u1.root.io.15"},{"fixed":"2.5.4-2+deb11u1.aikido.18"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2+deb11u1.root.io.8"},{"fixed":"2.5.4-2+deb11u1.root.io.4"},{"fixed":"2.5.4-2+deb11u1.root.io.6"},{"fixed":"2.5.4-2+deb11u1.root.io.7"},{"fixed":"2.5.4-2+deb11u1.root.io.13"},{"fixed":"2.5.4-2+deb11u1.root.io.2"},{"fixed":"2.5.4-2+deb11u1.root.io.3"},{"fixed":"2.5.4-2+deb11u1.root.io.14"},{"fixed":"2.5.4-2+deb11u1.root.io.5"},{"fixed":"2.5.4-2+deb11u1.root.io.10"},{"fixed":"2.5.4-2+deb11u1.aikido.17"},{"fixed":"2.5.4-2+deb11u1.root.io.9"},{"fixed":"2.5.4-2+deb11u1.root.io.12"},{"fixed":"2.5.4-2+deb11u1.aikido.16"},{"fixed":"2.5.4-2+deb11u1.root.io.11"},{"fixed":"2.5.4-2+deb11u1.root.io.15"},{"fixed":"2.5.4-2+deb11u1.aikido.18"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-5.root.io.8"},{"fixed":"3.1.5-5.root.io.9"},{"fixed":"3.1.5-5.root.io.10"},{"fixed":"3.1.5-5.root.io.7"},{"fixed":"3.1.5-5.root.io.3"},{"fixed":"3.1.5-5.root.io.5"},{"fixed":"3.1.5-5.root.io.4"},{"fixed":"3.1.5-5.root.io.15"},{"fixed":"3.1.5-5.root.io.6"},{"fixed":"3.1.5-5.root.io.2"},{"fixed":"3.1.5-5.root.io.21"},{"fixed":"3.1.5-5.root.io.22"},{"fixed":"3.1.5-5.root.io.12"},{"fixed":"3.1.5-5.root.io.23"},{"fixed":"3.1.5-5.root.io.13"},{"fixed":"3.1.5-5.root.io.14"},{"fixed":"3.1.5-5.root.io.11"},{"fixed":"3.1.5-5.root.io.16"},{"fixed":"3.1.5-5.root.io.17"},{"fixed":"3.1.5-5.root.io.18"},{"fixed":"3.1.5-5.root.io.19"},{"fixed":"3.1.5-5.root.io.20"},{"fixed":"3.1.5-5.aikido.24"},{"fixed":"3.1.5-5.aikido.25"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-5.root.io.8"},{"fixed":"3.1.5-5.root.io.9"},{"fixed":"3.1.5-5.root.io.10"},{"fixed":"3.1.5-5.root.io.7"},{"fixed":"3.1.5-5.root.io.3"},{"fixed":"3.1.5-5.root.io.5"},{"fixed":"3.1.5-5.root.io.4"},{"fixed":"3.1.5-5.root.io.15"},{"fixed":"3.1.5-5.root.io.6"},{"fixed":"3.1.5-5.root.io.2"},{"fixed":"3.1.5-5.root.io.21"},{"fixed":"3.1.5-5.root.io.22"},{"fixed":"3.1.5-5.root.io.12"},{"fixed":"3.1.5-5.root.io.23"},{"fixed":"3.1.5-5.root.io.13"},{"fixed":"3.1.5-5.root.io.14"},{"fixed":"3.1.5-5.root.io.11"},{"fixed":"3.1.5-5.root.io.16"},{"fixed":"3.1.5-5.root.io.17"},{"fixed":"3.1.5-5.root.io.18"},{"fixed":"3.1.5-5.root.io.19"},{"fixed":"3.1.5-5.root.io.20"},{"fixed":"3.1.5-5.aikido.24"},{"fixed":"3.1.5-5.aikido.25"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-2.root.io.1"},{"fixed":"3.1.13-2.root.io.2"},{"fixed":"3.1.13-2.root.io.3"},{"fixed":"3.1.13-2.root.io.4"},{"fixed":"3.1.13-2.root.io.6"},{"fixed":"3.1.13-2.root.io.7"},{"fixed":"3.1.13-2.root.io.5"},{"fixed":"3.1.13-2.root.io.8"},{"fixed":"3.1.13-2.aikido.14"},{"fixed":"3.1.13-2.root.io.10"},{"fixed":"3.1.13-2.root.io.11"},{"fixed":"3.1.13-2.root.io.9"},{"fixed":"3.1.13-2.root.io.13"},{"fixed":"3.1.13-2.root.io.12"},{"fixed":"3.1.13-2.aikido.15"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-2.root.io.1"},{"fixed":"3.1.13-2.root.io.2"},{"fixed":"3.1.13-2.root.io.3"},{"fixed":"3.1.13-2.root.io.4"},{"fixed":"3.1.13-2.root.io.6"},{"fixed":"3.1.13-2.root.io.7"},{"fixed":"3.1.13-2.root.io.5"},{"fixed":"3.1.13-2.root.io.8"},{"fixed":"3.1.13-2.aikido.14"},{"fixed":"3.1.13-2.root.io.10"},{"fixed":"3.1.13-2.root.io.11"},{"fixed":"3.1.13-2.root.io.9"},{"fixed":"3.1.13-2.root.io.13"},{"fixed":"3.1.13-2.root.io.12"},{"fixed":"3.1.13-2.aikido.15"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openexr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5-1.1"}]}],"bundled":4}],"products":[{"vendor":"academysoftwarefoundation","product":"openexr"},{"vendor":"openexr","product":"openexr"}],"references":[{"url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-x22w-82jp-8rvf","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/ShielderSec/poc/tree/main/CVE-2025-48074","tags":["x_refsource_MISC","Exploit","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48074","tags":["advisory"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/2df7802a6421bf39ed73a607392f01b3c6da4e4a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x22w-82jp-8rvf","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-48074","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48074.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-48074","tags":["advisory"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr","tags":["package"]},{"url":"https://pypi.org/project/openexr","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-48074","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48074","tags":["report"]},{"url":"https://github.com/AcademySoftwareFoundation/openexr/commit/501be087faa62d0fb7115ce3a0ebd7b4ef0117fc","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48074","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-48074","title":"OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.","status":"published","published":"2025-08-01T16:32:54.595Z","modified":"2025-08-01T17:09:00.696Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-23375","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.","status":"published","published":"2025-08-01T16:32:54Z","modified":"2025-08-01T17:09:00Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:32:02.018241Z"}],"ghsa":[{"id":"GHSA-x22w-82jp-8rvf","title":"OpenEXR Out-Of-Memory via Unbounded File Header Values","description":"### Summary\nThe OpenEXR file format defines many information about the final image inside of the file header, such as the size of data/display window.\n\nThe application trusts the value of `dataWindow` size provided in the header of the input file, and performs computations based on this value.\n\nThis may result in unintended behaviors, such as excessively large number of iterations and/or huge memory allocations.\n\n\n### Details\nA concrete example of this issue is present in the function `readScanline()` in `ImfCheckFile.cpp` at line 235, that performs a for-loop using the `dataWindow min.y` and `max.y` coordinates that can be arbitrarily large.\n\n```cpp\nin.setFrameBuffer (i);\n\nint step = 1;\n\n//\n// try reading scanlines. Continue reading scanlines\n// even if an exception is encountered\n//\nfor (int y = dw.min.y; y \u003c= dw.max.y; y += step) // \u003c-- THIS LOOP IS EXCESSIVE BECAUSE OF DW.MAX\n{\n    try\n    {\n        in.readPixels (y);\n    }\n    catch (...)\n    {\n        threw = true;\n\n        //\n        // in reduceTime mode, fail immediately - the file is corrupt\n        //\n        if (reduceTime) { return threw; }\n    }\n}\n```\n\nAnother example occurs in the `EnvmapImage::resize` function that in turn calls `Array2D\u003cT\u003e::resizeEraseUnsafe` passing the `dataWindow` X and Y coordinates and perform a huge allocation.\n\nOn some system, the allocator will simply return `std::bad_alloc` and crash. On other systems such as macOS, the allocator will happily continue with a \"small\" pre-allocation and allocate further memory whenever it is accessed.\nThis is the case with the `EnvmapImage::clear` function that is called right after and fills the image RGB values with zeros, allocating tens of Gigabytes.\n\n### PoC\n\nNOTE: please download the `oom_crash.exr` file via the following link:\n \nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-48074\n\n1. Compile the `exrcheck` binary in a macOS or GNU/Linux machine with ASAN.\n2. Open the `oom_crash.exr` file with the following command:\n\n```\nexrcheck oom_crash.exr\n```\n\n3. Notice that `exrenvmap`/`exrcheck` crashes with ASAN stack-trace.\n\n### Impact\nAn attacker could cause a denial of service by stalling the application or exhaust memory by stalling the application in a loop which contains a memory leakage.","status":"published","published":"2025-07-31T19:23:18Z","modified":"2026-06-11T14:09:47Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:26.12116Z"}],"nvd":[{"id":"CVE-2025-48074","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.","status":"published","published":"2025-08-01T17:15:52.193Z","modified":"2026-06-17T09:29:06.677Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:11:21.71471Z"}],"osv":[{"id":"ALPINE-CVE-2025-48074","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.","status":"published","published":"2025-08-01T17:15:52.193Z","modified":"2026-11-03T06:32:15.569282613Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2025-48074","title":"OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.","status":"published","published":"2025-08-01T16:32:54.595Z","modified":"2026-10-28T02:30:39.648743932Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-48074","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.","status":"published","published":"2025-08-01T17:15:52.193Z","modified":"2026-09-01T20:03:35.205389794Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-x22w-82jp-8rvf","title":"OpenEXR Out-Of-Memory via Unbounded File Header Values","description":"### Summary\nThe OpenEXR file format defines many information about the final image inside of the file header, such as the size of data/display window.\n\nThe application trusts the value of `dataWindow` size provided in the header of the input file, and performs computations based on this value.\n\nThis may result in unintended behaviors, such as excessively large number of iterations and/or huge memory allocations.\n\n\n### Details\nA concrete example of this issue is present in the function `readScanline()` in `ImfCheckFile.cpp` at line 235, that performs a for-loop using the `dataWindow min.y` and `max.y` coordinates that can be arbitrarily large.\n\n```cpp\nin.setFrameBuffer (i);\n\nint step = 1;\n\n//\n// try reading scanlines. Continue reading scanlines\n// even if an exception is encountered\n//\nfor (int y = dw.min.y; y \u003c= dw.max.y; y += step) // \u003c-- THIS LOOP IS EXCESSIVE BECAUSE OF DW.MAX\n{\n    try\n    {\n        in.readPixels (y);\n    }\n    catch (...)\n    {\n        threw = true;\n\n        //\n        // in reduceTime mode, fail immediately - the file is corrupt\n        //\n        if (reduceTime) { return threw; }\n    }\n}\n```\n\nAnother example occurs in the `EnvmapImage::resize` function that in turn calls `Array2D\u003cT\u003e::resizeEraseUnsafe` passing the `dataWindow` X and Y coordinates and perform a huge allocation.\n\nOn some system, the allocator will simply return `std::bad_alloc` and crash. On other systems such as macOS, the allocator will happily continue with a \"small\" pre-allocation and allocate further memory whenever it is accessed.\nThis is the case with the `EnvmapImage::clear` function that is called right after and fills the image RGB values with zeros, allocating tens of Gigabytes.\n\n### PoC\n\nNOTE: please download the `oom_crash.exr` file via the following link:\n \nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-48074\n\n1. Compile the `exrcheck` binary in a macOS or GNU/Linux machine with ASAN.\n2. Open the `oom_crash.exr` file with the following command:\n\n```\nexrcheck oom_crash.exr\n```\n\n3. Notice that `exrenvmap`/`exrcheck` crashes with ASAN stack-trace.\n\n### Impact\nAn attacker could cause a denial of service by stalling the application or exhaust memory by stalling the application in a loop which contains a memory leakage.","status":"published","published":"2025-07-31T19:23:18Z","modified":"2026-07-07T17:56:48.2515861Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"PYSEC-2026-1749","title":"OpenEXR Out-Of-Memory via Unbounded File Header Values","description":"### Summary\nThe OpenEXR file format defines many information about the final image inside of the file header, such as the size of data/display window.\n\nThe application trusts the value of `dataWindow` size provided in the header of the input file, and performs computations based on this value.\n\nThis may result in unintended behaviors, such as excessively large number of iterations and/or huge memory allocations.\n\n\n### Details\nA concrete example of this issue is present in the function `readScanline()` in `ImfCheckFile.cpp` at line 235, that performs a for-loop using the `dataWindow min.y` and `max.y` coordinates that can be arbitrarily large.\n\n```cpp\nin.setFrameBuffer (i);\n\nint step = 1;\n\n//\n// try reading scanlines. Continue reading scanlines\n// even if an exception is encountered\n//\nfor (int y = dw.min.y; y \u003c= dw.max.y; y += step) // \u003c-- THIS LOOP IS EXCESSIVE BECAUSE OF DW.MAX\n{\n    try\n    {\n        in.readPixels (y);\n    }\n    catch (...)\n    {\n        threw = true;\n\n        //\n        // in reduceTime mode, fail immediately - the file is corrupt\n        //\n        if (reduceTime) { return threw; }\n    }\n}\n```\n\nAnother example occurs in the `EnvmapImage::resize` function that in turn calls `Array2D\u003cT\u003e::resizeEraseUnsafe` passing the `dataWindow` X and Y coordinates and perform a huge allocation.\n\nOn some system, the allocator will simply return `std::bad_alloc` and crash. On other systems such as macOS, the allocator will happily continue with a \"small\" pre-allocation and allocate further memory whenever it is accessed.\nThis is the case with the `EnvmapImage::clear` function that is called right after and fills the image RGB values with zeros, allocating tens of Gigabytes.\n\n### PoC\n\nNOTE: please download the `oom_crash.exr` file via the following link:\n \nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-48074\n\n1. Compile the `exrcheck` binary in a macOS or GNU/Linux machine with ASAN.\n2. Open the `oom_crash.exr` file with the following command:\n\n```\nexrcheck oom_crash.exr\n```\n\n3. Notice that `exrenvmap`/`exrcheck` crashes with ASAN stack-trace.\n\n### Impact\nAn attacker could cause a denial of service by stalling the application or exhaust memory by stalling the application in a loop which contains a memory leakage.","status":"published","published":"2026-07-07T16:02:59.949434Z","modified":"2026-07-07T17:47:08.296800371Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2025-48074","title":"CVE-2025-48074 in openexr - Patched by Root","description":"Root has patched CVE-2025-48074 in the openexr package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-09-02T12:13:16Z","modified":"2026-09-02T14:00:05.425644279Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:29.631993Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-48074","title":"CVE-2025-48074 in openexr - Patched by Root","description":"Root has patched CVE-2025-48074 in the openexr package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-02T11:23:23Z","modified":"2026-09-02T12:30:06.207342409Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:31.514195Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2025-48074","title":"CVE-2025-48074 in openexr - Patched by Root","description":"Root has patched CVE-2025-48074 in the openexr package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-09-02T12:18:43Z","modified":"2026-09-02T14:00:08.546612763Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:33.153539Z"},{"id":"UBUNTU-CVE-2025-48074","description":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.","status":"withdrawn","published":"2025-08-01T17:15:00Z","modified":"2026-04-16T10:43:54.860261Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"openSUSE-SU-2025:15415-1","title":"libIex-3_3-32-3.3.5-1.1 on GA media","description":"These are all security issues fixed in the libIex-3_3-32-3.3.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-06T00:00:00Z","modified":"2026-03-23T04:53:44.859532Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}