CVE-2025-48074 - CVE House
Back to Database
Status published Medium CVE-2025-48074

OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors

Vulnerability Description

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48074

Credits & Attribution

No credits recorded in the NVD database.

References

More from AcademySoftwareFoundation

View All →
CVE-2025-64183
OpenEXR has use after free in PyObject_StealAttrString
Medium 5.5
CVE-2025-64182
OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()
Medium 5.5
CVE-2025-64181
OpenEXR Makes Use of Uninitialized Memory
Low 2
CVE-2025-53012
MaterialX's Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion
Medium 5.5
CVE-2025-53011
MaterialX is Vulnerable to NULL Pointer Dereference due to Unchecked implGraphOutput
Low 2

Affected Vendor

AcademySoftwareFoundation

View all reports →

Affected Software

openexr
Vulnerable Versions:
>= 3.3.2, < 3.3.3

Timeline

Official Publish: August 1st, 2025
Last Modified: August 1st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery