SB2026040872 - Multiple vulnerabilities in OpenEXR

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026040872

SB2026040872 - Multiple vulnerabilities in OpenEXR

Published: April 8, 2026

Security Bulletin ID SB2026040872
Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Medium 50% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2025-48074)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in file header processing when parsing a crafted OpenEXR file. A remote attacker can supply a file with unbounded dataWindow header values to cause a denial of service.

User interaction is required to open or process a crafted file.


2) NULL pointer dereference (CVE-ID: CVE-2025-48073)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ScanLineProcess::run_fill when processing a deep scanline image with a large sample count in reduceMemory mode. A remote attacker can supply a specially crafted EXR file to cause a denial of service.


3) Out-of-bounds read (CVE-ID: CVE-2025-48072)

The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.

The vulnerability exists due to out-of-bounds read in LossyDctDecoder_execute when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. A remote attacker can supply a specially crafted EXR file to cause a denial of service and disclose sensitive information.

The issue occurs when SSE2 is enabled and can be triggered with non-block aligned chunks whose width or height is not a multiple of 8.


4) Heap-based buffer overflow (CVE-ID: CVE-2025-48071)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in the undo_zip_impl function and deep scanline ZIP reconstruction logic when parsing a crafted ZIPS-packed deep scan-line EXR file with a forged chunk header. A remote attacker can supply a specially crafted EXR file to execute arbitrary code.

User interaction is required to open or process a crafted EXR file.


Remediation

Install update from vendor's website.

References