CVE-2025-48072
BaseFortify
Publication date: 2025-07-31
Last updated on: 2025-08-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openexr | openexr | 3.3.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a heap-based buffer overflow in OpenEXR version 3.3.2 that occurs during the reading of DWAA-packed scan-line EXR files. It is caused by incorrect pointer arithmetic when decompressing a maliciously crafted chunk in the file, which can lead to memory corruption. The issue is fixed in version 3.3.3.
How can this vulnerability impact me? :
The heap-based buffer overflow can lead to memory corruption, which may be exploited to cause a crash or potentially execute arbitrary code when processing a malicious EXR file. This can impact the security and stability of applications using the vulnerable OpenEXR version.
What immediate steps should I take to mitigate this vulnerability?
Upgrade OpenEXR to version 3.3.3 or later, as this version contains the fix for the heap-based buffer overflow vulnerability.