CVE-2025-48071: OpenEXR OpenEXR Heap-Based Buffer Overflow Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h45x-qhg2-q375",
  "modified" : "2025-08-13T21:37:55Z",
  "published" : "2025-07-31T19:12:56Z",
  "aliases" : [ "CVE-2025-48071" ],
  "summary" : "OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size",
  "details" : "### Summary\n\nThe OpenEXRCore code is vulnerable to a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header.\n\n### Details\nWhen parsing `STORAGE_DEEP_SCANLINE` chunks from an EXR file, the following code (from `src/lib/OpenEXRCore/chunk.c`) is used to extract the chunk information:\n\n```cpp\n\nif (part->storage_mode == EXR_STORAGE_DEEP_SCANLINE)\n// SNIP...\n        cinfo->sample_count_data_offset = dataoff;\n        cinfo->sample_count_table_size  = (uint64_t) ddata[0];\n        cinfo->data_offset              = dataoff + (uint64_t) ddata[0];\n        cinfo->packed_size              = (uint64_t) ddata[1];\n        cinfo->unpacked_size            = (uint64_t) ddata[2];\n// SNIP...\n```\n\nBy storing this information, the code that will later decompress and reconstruct the chunk bytes, will know how much space the uncompressed data will occupy.\n\nThis size is carried along in the chain of decoding/decompression until the `undo_zip_impl` function in `src/lib/OpenEXRCore/internal_zip.c`:\n\n```cpp\nstatic exr_result_t\nundo_zip_impl (\n    exr_decode_pipeline_t* decode,\n    const void*            compressed_data,\n    uint64_t               comp_buf_size,\n    void*                  uncompressed_data,\n    uint64_t               uncompressed_size,\n    void*                  scratch_data,\n    uint64_t               scratch_size)\n{\n    size_t       actual_out_bytes;\n    exr_result_t res;\n\n    if (scratch_size < uncompressed_size) return EXR_ERR_INVALID_ARGUMENT;\n\n    res = exr_uncompress_buffer (\n        decode->context,\n        compressed_data,\n        comp_buf_size,\n        scratch_data,\n        scratch_size,\n        &actual_out_bytes);\n\n    if (res == EXR_ERR_SUCCESS)\n    {\n        decode->bytes_decompressed = actual_out_bytes;\n        if (comp_buf_size > actual_out_bytes)\n            res = EXR_ERR_CORRUPT_CHUNK;\n        else\n            internal_zip_reconstruct_bytes (\n                uncompressed_data, scratch_data, actual_out_bytes);\n    }\n\n    return res;\n}\n```\n\nThe `uncompressed_size` comes from the `unpacked_size` extracted earlier, and the `uncompressed_data` is a buffer allocated by making space for the size \"advertised\" in the chunk information.\n\nHowever, `scratch_data` and `actual_out_bytes` will contain, after decompression, the uncompressed data and its size, respectively. \n\nThe vulnerability lies in the fact that the `undo_zip_impl` function lacks code to check whether `actual_out_bytes` is greater than `uncompressed_size`. \n\nThe effect is that, by setting the `unpacked_size` in the chunk header smaller than the actual chunk decompressed data, it is possible - in the `internal_zip_reconstruct_bytes` function - to overflow past the boundaries of a heap chunk.\n\n### PoC\n\nNOTE: you can download the `heap_overflow.exr` file from this link:\n\nhttps://github.com/ShielderSec/poc/tree/main/CVE-2025-48071\n\n1. Compile the `exrcheck` binary in a macOS or GNU/Linux machine with ASAN.\n2. Open the `heap_overflow.exr` file with the following command:\n\n```\nexrcheck heap_overflow.exr\n```\n\n3. Notice that `exrcheck` crashes with an ASAN stack-trace.\n![image](https://github.com/user-attachments/assets/57907073-bc9f-40bb-9030-16008035ade8)\n\n### Impact\n\nAn attacker might exploit this vulnerability by feeding a maliciously crafted file to a program that uses the OpenEXR libraries, thus gaining the capability to write an arbitrary amount of bytes in the heap. This could potentially result in code execution in the process.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "OpenEXR"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.3.0"
      }, {
        "fixed" : "3.3.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-h45x-qhg2-q375"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-48071"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/AcademySoftwareFoundation/openexr/commit/916cc729e24aa16b86d82813f6e136340ab2876f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/AcademySoftwareFoundation/openexr"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ShielderSec/poc/tree/main/CVE-2025-48071"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-122" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-07-31T19:12:56Z",
    "nvd_published_at" : "2025-07-31T21:15:27Z"
  }
}