CVE-2025-48071

HIGH

OpenEXR 3.3.0-3.3.2 - Heap-based Buffer Overflow via ZIPS-packed Deep Scan-line EXR Chunk Header

Title source: llm
STIX 2.1

Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.2 through 3.3.0, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header. This is fixed in version 3.3.3.

References (3)

Core 3

Scores

CVSS v3 7.8
EPSS 0.0030
EPSS Percentile 21.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-122
Status published
Products (2)
openexr/openexr 3.3.0 - 3.3.3
pypi/OpenEXR 3.3.0 - 3.3.3PyPI
Published Jul 31, 2025
Tracked Since Feb 18, 2026