CVE-2025-48071

A heap based-buffer overflow flaw was found in OpenEXR. In affected versions, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep-scan-line EXR files with a maliciously forged chunk header.

No Red Hat products or offerings are affected by this vulnerability.

This vulnerability should be considered Important rather than Moderate because it allows a heap-based buffer overflow during decompression of ZIPS-packed deep scan-line EXR files with a forged chunk header, which directly impacts memory safety. Heap overflows in image parsing libraries are particularly dangerous as they occur in low-level, high-performance C++ code that often lacks additional runtime protections. This flaw can be exploited by simply supplying a crafted EXR file, enabling a remote attacker to trigger arbitrary memory writes and potentially achieve code execution within the context of the application processing the file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.