OpenEXR, Memory Allocation Vulnerability, CVE-2025-48074 (Critical)

Listen to this Post

🐢▶️ Listen🚀

How the CVE Works

The vulnerability in OpenEXR arises due to unchecked header values in EXR image files. The `dataWindow` size parameters in the file header are trusted without validation, leading to excessive memory allocations or infinite loops. In `readScanline()` (ImfCheckFile.cpp), a loop iterates using untrusted `dataWindow.min.y` and `dataWindow.max.y` values, allowing arbitrary iteration counts. Similarly, `EnvmapImage::resize` calls `Array2D::resizeEraseUnsafe` with unchecked coordinates, triggering massive memory allocations. On macOS, lazy allocation may delay crashes, while other systems fail immediately with std::bad_alloc. Attackers can craft malicious EXR files to exhaust memory or crash applications.

DailyCVE Form

Platform: OpenEXR
Version: Affects multiple
Vulnerability: Memory exhaustion
Severity: Critical
Date: 2025-04-15

Prediction: Patch by 2025-06-30

What Undercode Say

Compile with ASAN
clang++ -fsanitize=address -o exrcheck ImfCheckFile.cpp
Trigger crash
./exrcheck oom_crash.exr

How Exploit

• Craft EXR with oversized `dataWindow` values.
• Submit to target application parsing EXR files.
• Trigger memory exhaustion or crash.

Protection from this CVE

• Validate `dataWindow` bounds.
• Use memory limits.
• Update to patched version.

Impact

• DoS via memory exhaustion.
• Application crashes.
• Potential RCE in edge cases.

🎯Let’s Practice Exploiting & Learn Patching For Free:

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin