CVE-2025-48073CWE-476

OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

Medium · published July 31, 2025

CVSS v4.0
4.6
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. This is fixed in version 3.3.3.

The record
Technical detail
CVSS v4.0
4.6 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00212 · 10.9th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-07-31T20:25Z
EPSS history
Timeline
  • 31 JUL 20:25Z
    OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode
    cvelistv5