PT-2025-31589 · Openexr+1 · Openexr+1

Ndaprela + 3 · Published 2025-07-31 · Updated 2026-06-01 · CVE-2025-48074

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.3.3

Description OpenEXR is an image storage format used in the motion picture industry. Versions prior to 3.3.3 trust unvalidated dataWindow size values from file headers, potentially leading to excessive memory allocation and performance degradation when processing malicious files.

Recommendations Update to version 3.3.3 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-48074

ECHO-F43E-2C25-B994

GHSA-X22W-82JP-8RVF

OPENSUSE-SU-2025:15415-1

Affected Products

Debian

Openexr

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48074.json · Exploit
• 🔥 https://github.com/ShielderSec/poc/tree/main/CVE-2025-48074 · Exploit
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-x22w-82jp-8rvf · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-48074 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-48074 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-48074 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2025-48074 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-48074 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-48074 · Security Note
• https://osv.dev/vulnerability/GHSA-x22w-82jp-8rvf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48074 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48074 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15415-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-48074 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2025-48074 · Vendor Advisory