CVSS 4.0
4.6 mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NCVE-2025-48073
Medium (4.6) in openexr openexr. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in openexr 3.3.3.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. This is fixed in version 3.3.3.
Severity
CVSS 3.1
6.2 mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
- CWE
- CWE-476
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openexr:openexr
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qhpm-86v7-phmm | PyPI | openexr | >=3.3.2 <3.3.3 | 3.3.3 |
| PYSEC-2026-1748 | PyPI | openexr | >=3.3.2 <3.3.3 | 3.3.3 |