CVE-2025-48072: OpenEXR Heap-Based Buffer Overflow Due to Bad Pointer Arithmetic
Summary
CVE-2025-48072: OpenEXR Out of Bounds Heap Read due to Bad Pointer Arithmetic in LossyDctDecoder_execute. Affects openexr versions >= 3.3.2, < 3.3.3. Fixed in 3.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenEXR is an open-source high dynamic range (HDR) image file format developed by Industrial Light & Magic (ILM) for visual effects and animation. It is widely used in the film and visual effects industry due to its ability to store a wide range of color data and support for multiple layers and channels. The package is designed for high-performance image processing and is often integrated into various graphics applications. However, it has been found to be vulnerable to a heap-based buffer overflow, which can lead to application crashes and potential data leaks.
Vulnerability Detail
The vulnerability arises from a flaw in the LossyDctDecoder_execute function within the OpenEXRCore library, specifically when decompressing DWAA-packed scan-line EXR files. The issue is caused by incorrect pointer arithmetic, where a __m128i pointer is incremented as if it were a uint16_t pointer. This can lead to out-of-bounds memory access, resulting in a heap-based buffer overflow during read operations. An attacker could exploit this vulnerability to crash the application or potentially leak sensitive information.
How To Fix
Latest published version: 3.5.2 as of 23 Oct 2026
pip install --upgrade "openexr==3.5.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.3
This is the first release that contains the fix.
pip install --upgrade "openexr==3.3.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as possible.
Conclusion
The OpenEXR package has a critical vulnerability (CVE-2025-48072) that can lead to severe consequences if not addressed. Users are strongly encouraged to update to the latest version to protect their applications from potential exploitation.
See every vulnerability recorded for openexr →
FAQ
CVE-2025-48072 is a vulnerability in the OpenEXR package that allows for a heap-based buffer overflow due to bad pointer arithmetic.
Exploiting this vulnerability can lead to application crashes and potential leakage of sensitive information, such as memory addresses.
Versions prior to 3.3.3 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring access to the code or installation.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for openexr.
