crítica
CVE-2025-48072
openexr: OpenEXR Out of Bounds Read
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Red Hat5.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (media), Red Hat (media), Ubuntu (media).
Descripción
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.2-r0 |
| alpine 3.24 | openexr | 3.4.2-r0 |
| alpine edge | openexr | 3.4.2-r0 |
| pip::GitHub Security Advisory pip | openexr | 3.3.3 |
| rapidfort alpine 3.20 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.21 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.22 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.23 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.24 | openexr | 3.3.11-r0 |
| rapidfort ubuntu 20.04 | openexr, rf-openexr | sin corrección indicada |
| rapidfort ubuntu 22.04 | openexr, rf-openexr | sin corrección indicada |
Mostrar las 18 entradas de 15 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.2-r0 |
| alpine 3.24 | openexr | 3.4.2-r0 |
| alpine edge | openexr | 3.4.2-r0 |
| pip::GitHub Security Advisory pip | openexr | 3.3.3 |
| rapidfort alpine 3.20 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.21 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.22 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.23 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.24 | openexr | 3.3.11-r0 |
| rapidfort ubuntu 20.04 | openexr | sin corrección indicada |
| rapidfort ubuntu 20.04 | rf-openexr | sin corrección indicada |
| rapidfort ubuntu 22.04 | openexr | sin corrección indicada |
| rapidfort ubuntu 22.04 | rf-openexr | sin corrección indicada |
| rapidfort ubuntu 24.04 | openexr | sin corrección indicada |
| rapidfort ubuntu 24.04 | rf-openexr | sin corrección indicada |
| ubuntu 26.04 | openexr | sin corrección indicada |
| ubuntu 26.10 | openexr | sin corrección indicada |
Referencias
- https://access.redhat.com/security/cve/CVE-2025-48072
- https://github.com/AcademySoftwareFoundation/openexr
- https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361
- https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361%20%28v3.3.3-rc%29
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43
- https://github.com/ShielderSec/poc/tree/main/CVE-2025-48072
- https://nvd.nist.gov/vuln/detail/CVE-2025-48072