CVE-2025-48074: OpenEXR Package Suffers from Out-Of-Memory Vulnerability Due to Unbounded File Header Values
Summary
CVE-2025-48074: OpenEXR Out-Of-Memory via Unbounded File Header Values. Affects openexr versions >= 3.3.2, < 3.3.3. Fixed in 3.3.3. How to fix ↓
Also tracked for
- openexr · Debian:11
The same CVE-2025-48074 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenEXR is an open-source high dynamic range (HDR) image file format developed by Industrial Light & Magic (ILM) for visual effects and animation. It is widely used in the film and visual effects industry due to its ability to store multiple channels of data, including color, depth, and other image attributes. The package is designed to handle complex image data efficiently, but it is vulnerable to issues arising from untrusted input in the form of file headers, which can lead to excessive memory allocation and application crashes.
Vulnerability Detail
The vulnerability arises from the OpenEXR file format's reliance on the values provided in the file header, specifically the 'dataWindow' size. The application does not validate these values, allowing an attacker to craft a malicious file that can cause excessive iterations and large memory allocations during processing. This can lead to denial of service (DoS) by stalling the application or exhausting system memory, potentially crashing the application. The vulnerability is exemplified in the 'readScanline()' function, where a for-loop iterates based on the 'dataWindow' coordinates, which can be arbitrarily large, leading to excessive resource consumption.
How To Fix
Latest published version: 3.5.2 as of 23 Oct 2026
pip install --upgrade "openexr==3.5.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.3
This is the first release that contains the fix.
pip install --upgrade "openexr==3.3.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted OpenEXR files or implement additional validation checks on the 'dataWindow' values before processing them in your application. This can help prevent excessive memory allocation and potential crashes.
Conclusion
CVE-2025-48074 is a significant vulnerability in the OpenEXR package that can lead to denial of service through excessive memory allocation. Users are advised to update to the latest version to mitigate this risk and consider implementing validation checks as a temporary workaround.
See every vulnerability recorded for openexr →
FAQ
CVE-2025-48074 is a vulnerability in the OpenEXR package that allows for out-of-memory conditions due to unbounded values in file headers.
If your application processes OpenEXR files, it may be susceptible to crashes or excessive memory usage, leading to denial of service.
Implement validation checks on the 'dataWindow' values in OpenEXR files to prevent excessive memory allocation as a temporary measure.
The patched version of OpenEXR is available on PyPI. You can update it using 'pip install --upgrade openexr'.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. Check your application for vulnerabilities using the Vulert playground at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for openexr.
