CVE-2025-48072: 
Python vulnerability analysis and mitigation

CVE-2025-48072 is an out-of-bounds heap read vulnerability in OpenEXR titled "Out of Bounds Heap Read due to Bad Pointer Arithmetic in LossyDctDecoder_execute." It affects OpenEXR version 3.3.2 exclusively and was disclosed on July 31, 2025, with a fix released in version 3.3.3. The flaw occurs during decompression of DWAA-packed scan-line EXR files when processing maliciously forged chunks. It carries a CVSS v4.0 base score of 6.8 (Medium) and a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, OpenEXR Release).

The root cause is incorrect pointer arithmetic (CWE-125: Out-of-bounds Read) in the LossyDctDecoder_execute function within src/lib/OpenEXRCore/internal_dwa_decoder.h, triggered only when SSE2 is enabled. Specifically, a __m128i* (128-bit SSE) pointer (src) is incremented by 8*8 as if it were a uint16_t* pointer, resulting in a stride of 128 bytes per iteration instead of the correct 16 bytes. In non-block-aligned chunks (where image width or height is not a multiple of 8), this causes src to advance past the allocated heap buffer boundaries. An attacker can trigger this by supplying a crafted .exr file with a maliciously forged DWAA-compressed chunk; a public proof-of-concept file (dwadecoder_crash.exr) is available at the ShielderSec GitHub repository (Github Advisory, Patch Commit).

Successful exploitation can crash the application (denial of service) and, in some scenarios, leak sensitive heap memory contents — including memory addresses that could be used to defeat exploit mitigations such as ASLR. The confidentiality impact is rated high, as out-of-bounds reads may expose sensitive data from adjacent heap regions. Integrity is not directly affected, but memory address leakage could facilitate further exploitation in chained attack scenarios (Github Advisory).

A public proof-of-concept exploit file (dwadecoder_crash.exr) has been published by ShielderSec and is referenced in the official advisory. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (per Feedly data), indicating low near-term exploitation probability. Exploitation requires user interaction — a victim must open a maliciously crafted EXR file with a vulnerable application (Github Advisory).

1. Craft a malicious EXR file: Create or obtain a DWAA-compressed scan-line EXR file with a non-block-aligned image dimension (width or height not a multiple of 8) and a forged chunk structure. The public PoC file dwadecoder_crash.exr from ShielderSec's repository can be used directly.
2. Deliver the file to the target: Distribute the malicious .exr file via email attachment, file share, web upload, or any channel where the victim uses an application built on OpenEXR 3.3.2 (e.g., VFX/rendering software, image viewers).
3. Trigger decompression: The victim opens the file with a vulnerable application. The application invokes DwaCompressor_uncompress → LossyDctDecoder_execute with SSE2 enabled.
4. Trigger out-of-bounds read: The incorrect src pointer increment (src += 8*8 as __m128i*) causes the SSE2 _mm_loadu_si128 instruction to read 16 bytes from beyond the allocated heap buffer.
5. Achieve impact: The application crashes (DoS), and/or heap memory contents (potentially including sensitive data or memory addresses) are read and may be observable through error output or side-channel effects, enabling ASLR bypass for further exploitation (Github Advisory, Patch Commit).

• File System: Presence of unexpected or externally sourced .exr files with DWAA compression and non-standard dimensions (non-multiples of 8) in directories processed by OpenEXR-based applications.
• Process: Application crashes or abnormal termination of processes using OpenEXR 3.3.2 when opening .exr files; ASAN reports of heap-buffer-overflow in LossyDctDecoder_execute at internal_dwa_decoder.h:650.
• Logs: Crash dumps or core files referencing stack frames in LossyDctDecoder_execute, DwaCompressor_uncompress, internal_exr_undo_dwaa, or exr_uncompress_chunk; error messages referencing READ of size 16 at addresses beyond allocated heap regions (Github Advisory).

The fix is available in OpenEXR version 3.3.3, released March 24, 2025, which corrects the pointer arithmetic in LossyDctDecoder_execute (changing src += 8*8 to src += 8 for the __m128i* type) and adds additional null/bounds checks in related code paths. Users should upgrade from version 3.3.2 to 3.3.3 immediately. As a workaround where upgrading is not immediately possible, restrict processing of EXR files to trusted sources only and avoid opening DWAA-compressed EXR files from untrusted origins (OpenEXR Release, Patch Commit).

The vulnerability was reported by researchers suidpit, TheZ3ro, ndaprela, and smaury (credited in the advisory), suggesting coordinated security research. Red Hat has tracked the vulnerability and published a CVE entry. SUSE has issued package updates addressing this and related OpenEXR vulnerabilities. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (Github Advisory, Red Hat CVE).