kritisch
CVE-2025-48072
openexr: OpenEXR Out of Bounds Read
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Red Hat5.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (mittel), Red Hat (mittel), Ubuntu (mittel).
Beschreibung
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.2-r0 |
| alpine 3.24 | openexr | 3.4.2-r0 |
| alpine edge | openexr | 3.4.2-r0 |
| pip::GitHub Security Advisory pip | openexr | 3.3.3 |
| rapidfort alpine 3.20 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.21 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.22 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.23 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.24 | openexr | 3.3.11-r0 |
| rapidfort ubuntu 20.04 | openexr, rf-openexr | kein Fix angegeben |
| rapidfort ubuntu 22.04 | openexr, rf-openexr | kein Fix angegeben |
Alle 18 Einträge aus 15 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.2-r0 |
| alpine 3.24 | openexr | 3.4.2-r0 |
| alpine edge | openexr | 3.4.2-r0 |
| pip::GitHub Security Advisory pip | openexr | 3.3.3 |
| rapidfort alpine 3.20 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.21 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.22 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.23 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.24 | openexr | 3.3.11-r0 |
| rapidfort ubuntu 20.04 | openexr | kein Fix angegeben |
| rapidfort ubuntu 20.04 | rf-openexr | kein Fix angegeben |
| rapidfort ubuntu 22.04 | openexr | kein Fix angegeben |
| rapidfort ubuntu 22.04 | rf-openexr | kein Fix angegeben |
| rapidfort ubuntu 24.04 | openexr | kein Fix angegeben |
| rapidfort ubuntu 24.04 | rf-openexr | kein Fix angegeben |
| ubuntu 26.04 | openexr | kein Fix angegeben |
| ubuntu 26.10 | openexr | kein Fix angegeben |
Referenzen
- https://access.redhat.com/security/cve/CVE-2025-48072
- https://github.com/AcademySoftwareFoundation/openexr
- https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361
- https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361%20%28v3.3.3-rc%29
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43
- https://github.com/ShielderSec/poc/tree/main/CVE-2025-48072
- https://nvd.nist.gov/vuln/detail/CVE-2025-48072