OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode
Priority MEDIUM 54CWE-476Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-476.
Summary
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. This is fixed in version 3.3.3.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00228 13th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed openexr (AcademySoftwareFoundation): 3.3.3OpenEXR (PyPI): 3.3.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AcademySoftwareFoundation | openexr | 3.3.2 to before 3.3.3 | 3.3.3 | Patch available | CNA |
| — | OpenEXR (PyPI) | 3.3.2 to before 3.3.3 | 3.3.3 | Patch available | GHSA-qhpm-86v7-phmm |
- openexr VendorAcademySoftwareFoundation Affected 3.3.2 to before 3.3.3 Fixed in 3.3.3 Patch available CNA
- OpenEXR (PyPI) Vendor— Affected 3.3.2 to before 3.3.3 Fixed in 3.3.3 Patch available GHSA-qhpm-86v7-phmm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openexr:openexr:3.3.2:*:*:*:*:*:*:* | 3.3.2 | Vulnerable | Academy Software Foundation |
- cpe:2.3:a:openexr:openexr:3.3.2:*:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·Academy Software Foundation
Remediation
- Fix · CNA openexr (AcademySoftwareFoundation) Fixed in 3.3.3
- Fix · GHSA-qhpm-86v7-phmm OpenEXR (PyPI) Fixed in 3.3.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2025-48073
- 2026-10-03 Alias added: GHSA-qhpm-86v7-phmm
References
More AcademySoftwareFoundation vulnerabilities
- TI-2026-30739 OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser CVSS 4.0HIGH 8.4
- TI-2026-38605 OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS) CVSS 4.0HIGH 7.1
- TI-2026-48281 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union CVSS 3.1HIGH 7.1
- TI-2026-48279 OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision CVSS 3.1HIGH 7.1
- TI-2026-42768 OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow CVSS 3.1HIGH 7.1
- TI-2026-42338 OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin CVSS 3.1HIGH 7.1
Sources
- CVE-2025-48073 · CVE Program
- CVE-2025-48073 · NVD
- FIRST EPSS
- GHSA-qhpm-86v7-phmm · GitHub Advisory Database · CC BY 4.0
- CVE-2025-48073 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences