GCVE - cpe:2.3:a:openexr:openexr:3.3.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:openexr:openexr:3.3.2:*:*:*:*:*:*:*

part: a version: 3.3.2 update: *

Vendor	Openexr (`08ce74b1-05b9-58fb-83f7-0c8ed1ec29e3`)
Product	Openexr (`196f479f-4ee9-57fc-a417-07742a16506e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/openexr`	purl2cpe	2026-06-01 10:12:29.820166
`pkg:deb/ubuntu/openexr`	purl2cpe	2026-06-01 10:12:29.820168
`pkg:github/academysoftwarefoundation/openexr`	purl2cpe	2026-06-01 10:12:29.820169
`pkg:rpm/opensuse/openexr`	purl2cpe	2026-06-01 10:12:29.820172
`pkg:rpmfind/fedora/openexr`	purl2cpe	2026-06-01 10:12:29.820170

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-48074`	vulnerable	2026-06-08 07:27:15.450964	OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3. Published: 2025-08-01T16:32:54.595Z Updated: 2025-08-01T17:09:00.696Z Open on db.gcve.eu Reference links https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-x22w-82jp-8rvf https://github.com/ShielderSec/poc/tree/main/CVE-2025-48074	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-48073`	vulnerable	2026-06-08 07:27:15.450524	OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. This is fixed in version 3.3.3. Published: 2025-07-31T20:25:51.545Z Updated: 2025-07-31T20:36:41.060Z Open on db.gcve.eu Reference links https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-qhpm-86v7-phmm https://github.com/ShielderSec/poc/tree/main/CVE-2025-48073	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-48072`	vulnerable	2026-06-08 07:27:15.450128	OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3. Published: 2025-07-31T20:18:40.598Z Updated: 2025-07-31T20:37:21.287Z Open on db.gcve.eu Reference links https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43 https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361 https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

OpenEXR 3.3.2

Notes

PURL mappings

Vulnerability references

Contribute