CVE-2025-48072

Katalog CVE

CVSS 9.1 · Critical EPSS 0,51%

Kerentanan Out-of-bounds Read pada openexr. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.

Rincian

Terbit di NVD

31 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43 exploit · advisory vendor
• https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361 patch
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3 release notes