CVE-2025-48071: OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing
Summary
CVE-2025-48071: OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size. Affects openexr versions >= 3.3.0, < 3.3.3. Fixed in 3.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenEXR is an open-source high dynamic range image file format developed by Industrial Light & Magic. It is widely used in visual effects and animation for its ability to store complex image data efficiently. The library provides features such as deep data storage and multi-channel support, making it a popular choice among professionals in the film and animation industry. However, it is susceptible to vulnerabilities that can be exploited if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2025-48071 is a heap-based buffer overflow that occurs during the decompression of ZIPS-packed deep scan-line EXR files. This issue arises when the OpenEXRCore code fails to validate the size of the uncompressed data against the expected size specified in the chunk header. An attacker can exploit this flaw by crafting a malicious EXR file that causes the application to write beyond the allocated memory, potentially leading to arbitrary code execution.
How To Fix
Latest published version: 3.5.2 as of 23 Oct 2026
pip install --upgrade "openexr==3.5.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.3
This is the first release that contains the fix.
pip install --upgrade "openexr==3.3.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing EXR files from untrusted sources until the package is updated. Additionally, consider implementing input validation to check the integrity of EXR files before processing them.
Conclusion
CVE-2025-48071 represents a significant security risk for applications using the OpenEXR library. By understanding the nature of this vulnerability and taking the necessary steps to update the package, users can protect their systems from potential exploitation. Regular monitoring and validation of dependencies are crucial for maintaining software security.
See every vulnerability recorded for openexr →
FAQ
CVE-2025-48071 is a vulnerability in the OpenEXR library that allows for a heap-based buffer overflow during the decompression of specially crafted EXR files.
An attacker can exploit this vulnerability by providing a malicious EXR file that has a forged chunk header, leading to memory corruption and potential code execution.
Exploitation of this vulnerability can lead to arbitrary code execution, which may compromise the security of the application and the system it runs on.
Yes, the vulnerability has been patched in version 3.3.3 of the OpenEXR package. Users are advised to update to this version or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for openexr.
