PT-2025-31585 · Openexr · Openexr

Ndaprela + 3 · CVE-2025-48071 · Published 2025-07-31 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.3.0 through 3.3.2

Description OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. A heap-based buffer overflow occurs during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header.

Recommendations Update to version 3.3.3 or later.

Exploit

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2025-48071

GHSA-H45X-QHG2-Q375

OPENSUSE-SU-2025:15415-1

PYSEC-2026-1747

ZDI-25-834

Affected Products

Openexr

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48071.json · Exploit
• 🔥 https://github.com/ShielderSec/poc/tree/main/CVE-2025-48071 · Exploit
• https://github.com/AcademySoftwareFoundation/openexr/commit/916cc729e24aa16b86d82813f6e136340ab2876f · Patch
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-h45x-qhg2-q375 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48071 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-48071 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-48071 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h45x-qhg2-q375 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1747 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15415-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-48071 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48071 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-834 · Security Note
• https://github.com/AcademySoftwareFoundation/openexr · Note
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3 · Note