CVE-2025-48073 Overview
CVE-2025-48073 is a null pointer dereference vulnerability [CWE-476] in OpenEXR, the reference implementation of the EXR image file format used across the motion picture industry. The flaw affects version 3.3.2 when reading a deep scanline image with a large sample count in reduceMemory mode. A crafted EXR file triggers a null pointer dereference during a write operation, crashing the target application. The issue is fixed in version 3.3.3. Exploitation requires local access and user interaction, such as opening a malicious image with a vulnerable tool. The impact is limited to denial of service against the process consuming the file.
Critical Impact
A crafted deep scanline EXR file can crash any application using OpenEXR 3.3.2 in reduceMemory mode, disrupting image processing pipelines and rendering workflows.
Affected Products
- OpenEXR 3.3.2
- Applications embedding the OpenEXR 3.3.2 library
- Motion picture and VFX tooling that processes deep scanline EXR files with reduceMemory enabled
Discovery Timeline
- 2025-07-31 - CVE-2025-48073 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48073
Vulnerability Analysis
OpenEXR provides an image format designed for high dynamic range imagery used in film and visual effects. The library supports deep scanline images, which store multiple samples per pixel to represent volumetric data. When callers enable reduceMemory mode, the reader takes an alternate code path to minimize memory consumption during decoding.
In version 3.3.2, this path fails to correctly handle a deep scanline image containing a large sample count. A required buffer or output pointer remains null when the code reaches a subsequent write operation. Dereferencing that pointer terminates the process with a segmentation fault.
Because OpenEXR is embedded in rendering engines, compositors, and asset pipelines, the crash propagates to any host application that processes an attacker-supplied EXR file. The vulnerability does not enable code execution or data disclosure. See the OpenEXR Security Advisory GHSA-qhpm-86v7-phmm for additional context.
Root Cause
The defect is a missing null check in the deep scanline decoder path used when reduceMemory mode is active. Under specific sample-count conditions the allocation or lookup that should provide a destination pointer returns null, and the following write dereferences it. This maps to [CWE-476] Null Pointer Dereference.
Attack Vector
Exploitation requires an attacker to deliver a crafted deep scanline EXR file to a victim who opens it with a tool that links OpenEXR 3.3.2 and enables reduceMemory mode. A proof of concept is published at the Shielder PoC repository for CVE-2025-48073. No authentication is required, but the interaction is local and results only in a crash of the consuming process.
No verified exploit code is reproduced here. Refer to the linked advisory and PoC for technical detail.
Detection Methods for CVE-2025-48073
Indicators of Compromise
- Repeated crashes or segmentation faults in applications that decode EXR files, especially rendering, compositing, or asset ingest tools.
- EXR files containing deep scanline data with unusually large per-pixel sample counts.
- Core dumps referencing OpenEXR symbols in the deep scanline read path.
Detection Strategies
- Inventory build artifacts and containers for OpenEXR 3.3.2 using software composition analysis against the component name openexr:openexr.
- Scan file ingest queues for EXR files whose header advertises deep scanline storage and validate sample counts before handing them to older library versions.
- Correlate application crash telemetry with recent EXR file opens to identify targeted delivery.
Monitoring Recommendations
- Enable application crash reporting on workstations and render nodes and forward reports to central log storage.
- Alert when the same user or share delivers multiple malformed EXR files in a short window.
- Track OpenEXR library versions across the fleet and flag any host still running 3.3.2.
How to Mitigate CVE-2025-48073
Immediate Actions Required
- Upgrade OpenEXR to version 3.3.3 or later on every host that decodes EXR content.
- Rebuild and redeploy applications that statically link OpenEXR against the patched release.
- Block or quarantine untrusted deep scanline EXR files at ingest until the upgrade is complete.
Patch Information
The OpenEXR maintainers fixed the null pointer dereference in version 3.3.3. Details are published in the OpenEXR Security Advisory GHSA-qhpm-86v7-phmm. Downstream distributions and container base images should be updated once vendor packages incorporate 3.3.3.
Workarounds
- Disable reduceMemory mode in applications that expose the setting, since the crash path requires that mode.
- Restrict EXR ingestion to trusted sources and require internal validation of file headers before processing.
- Isolate EXR decoding in sandboxed worker processes so a crash cannot terminate the parent pipeline.
# Verify installed OpenEXR version and upgrade
pkg-config --modversion OpenEXR
# Debian and Ubuntu
sudo apt update && sudo apt install --only-upgrade libopenexr-dev
# Python bindings
pip install --upgrade openexr
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
