{"id":"CVE-2025-48072","summary":"OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap","details":"OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.","aliases":["GHSA-4r7w-q3jg-ff43","PYSEC-2026-1746"],"modified":"2026-10-22T16:07:51.964011002Z","published":"2025-07-31T20:18:40.598Z","related":["openSUSE-SU-2025:15415-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48072.json"},"references":[{"type":"WEB","url":"https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3"},{"type":"ADVISORY","url":"https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48072.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48072"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/academysoftwarefoundation/openexr","events":[{"introduced":"55d1a1404cec5b4b187009d9f7fe55a5622ac4e5"},{"fixed":"da760aa4b6bee4b9d74b8c6a151221b035fc47b7"},{"fixed":"2d09449427b13a05f7c31a98ab2c4347c23db361"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"3.3.2"},{"fixed":"3.3.3"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"2d09449427b13a05f7c31a98ab2c4347c23db361"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v3.3.3","range":[{"fixed":"da760aa4b6bee4b9d74b8c6a151221b035fc47b7"}]}]}}],"versions":["3.3.2","v3.3.2-rc4","v3.3.2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48072.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["274433651755456653323955633236949868332","188027014227960996441135252834635910679","193624059754130909841094947972942293734"],"threshold":0.9},"id":"CVE-2025-48072-2e6d09bc","signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361","target":{"file":"src/lib/OpenEXRCore/internal_dwa_simd.h"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361","target":{"file":"src/lib/OpenEXRCore/internal_dwa_compressor.h","function":"DwaCompressor_uncompress"},"deprecated":false,"digest":{"function_hash":"259759455048389141693783048163270713721","length":8580},"id":"CVE-2025-48072-826d2813"},{"digest":{"line_hashes":["94677635558605541585422504551912468268","274017415931204052869759526068103697500","279187138041181746497149862317631816239","143255403374197764343224970019973945455","183531893983815666370239179853916202344","7083542904461746273607083382821290248","55236131524140018281482971319627637861","70831952295213511114928233275890775590","24571941303375354260925371469237684457","266407878776353295354849046351918562410","269681334115857480102460157274194766755","72956887935417788943493904286519075091","202467842180158386962436666413554151838","247868452447712467244746955147157075696","53760250827206533182248305261586264243","110309531562151940651279106527705701190","299770262507230269658450112493708979568","224599227790951260935381168744429954290","328452796824966389403669506428514422336","325746148016260778714777343060479482815","81399841891658914783614135219701026813","257857008947836162915514458133300514635","102489546907061455533405108383981778750","26538521765607233370282470645864078196"],"threshold":0.9},"id":"CVE-2025-48072-cc203021","signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361","target":{"file":"src/lib/OpenEXRCore/internal_dwa_decoder.h"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361","target":{"file":"src/lib/OpenEXRCore/internal_dwa_compressor.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["111611059768555203434292305549306578959","33417070984990437013420018820871124159","123098260340733952797424410537636231499","200919031206287408256430183014396040968","310963971420179269122010576574882548715","184491194021044338492121022463707238512","129885633759663402921305308894077675752","251703495415245039780040825436003003284","191797475800762139638455285379295812478","313813226500627706806647252290912752249","201581386373132267864472573255465780957","12242984125906709032525777051645947663","38950339852476872101535483620326763198","308110945526832994721356442225777733315"]},"id":"CVE-2025-48072-ea5c3cee"},{"deprecated":false,"digest":{"function_hash":"144275601935870240001809160567299944427","length":7224},"id":"CVE-2025-48072-edb5d7ce","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361","target":{"file":"src/lib/OpenEXRCore/internal_dwa_decoder.h","function":"LossyDctDecoder_execute"}}],"vanir_signatures_modified":"2026-10-22T16:07:51Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}]}