CVE-2025-48071CWE-122

OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline Parsing

High · published July 31, 2025

CVSS v4.0
8.4
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.2 through 3.3.0, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header. This is fixed in version 3.3.3.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00365 · 29.1th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2025-07-31T20:13Z
EPSS history
Timeline
  • 31 JUL 20:13Z
    OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline Parsing
    cvelistv5