Mittel

OpenEXR Out of Bounds Heap Read due to Bad Pointer Arithmetic in LossyDctDecoder_execute

Veröffentlicht: 31.07.2025
Aktualisiert: 11.10.2026 13:19

Summary

The OpenEXRCore code is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk.

Details

In the LossyDctDecoder_execute function (from src/lib/OpenEXRCore/internal_dwa_decoder.h, when SSE2 is enabled), the following code is used to copy data from the chunks:

cpp

// no-op conversion to linear
for (int y = 8 * blocky; y < 8 * blocky + maxY; ++y)
{
    __m128i* restrict dst = (__m128i *) chanData[comp]->_rows[y];
    __m128i const * restrict src = (__m128i const *)&rowBlock[comp][(y & 0x7) * 8];

    for (int blockx = 0; blockx < numFullBlocksX; ++blockx)
    {
        _mm_storeu_si128 (dst, _mm_loadu_si128 (src)); //

        src += 8 * 8; // <--- si128 pointer incremented as a uint16_t
        dst += 8;
    }
}

The issue arises because the src pointer, which is a si128 pointer, is incremented by 8*8, as if it were a uint16_t pointer (64 * uint16_t == 128 bytes). In non-block aligned chunks (width/height not a multiple of 8), this can cause src to point past the boundaries of the chunk.

PoC

In order to reproduce the PoC with fidelity and avoid undefined behaviors, it is necessary to enable ASAN (and SSE2). Otherwise the out-of-bound read will not be detected until its side-effect causes a crash.

NOTE: please download the dwadecoder_crash.exr file from the following link:

https://github.com/ShielderSec/poc/tree/main/CVE-2025-48072

Compile the exrcheck binary in a macOS or GNU/Linux machine with ASAN.
Open the dwadecoder_crash.exr file with the following command:

exrcheck dwadecoder_crash.exr

Notice that exrcheck crashes with ASAN stack-trace.

==2297956==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x52500000a110 at pc 0x55e590db7bf1 bp 0x7fff948bb110 sp 0x7fff948bb108
READ of size 16 at 0x52500000a110 thread T0
    #0 0x55e590db7bf0 in LossyDctDecoder_execute /root/openexr/src/lib/OpenEXRCore/internal_dwa_decoder.h:650:48
    #1 0x55e590dae18d in DwaCompressor_uncompress /root/openexr/src/lib/OpenEXRCore/internal_dwa_compressor.h:1132:30
    #2 0x55e590da9960 in internal_exr_undo_dwaa /root/openexr/src/lib/OpenEXRCore/internal_dwa.c:202:18
    #3 0x55e590d42d03 in exr_uncompress_chunk /root/openexr/src/lib/OpenEXRCore/compression.c:516:14
    #4 0x55e590dc3132 in exr_decoding_run /root/openexr/src/lib/OpenEXRCore/decoding.c:580:14
    #5 0x55e590c7d78f in Imf_3_4::(anonymous namespace)::ScanLineProcess::run_decode(_priv_exr_context_t const*, int, Imf_3_4::FrameBuffer const*, int, int, std::vector<Imf_3_4::Slice, std::allocator<Imf_3_4::Slice>> const&) /root/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:585:23
    #6 0x55e590c83ed7 in Imf_3_4::ScanLineInputFile::Data::readPixels(Imf_3_4::FrameBuffer const&, int, int) /root/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:499:21
    #7 0x55e590c73c97 in Imf_3_4::ScanLineInputFile::readPixels(int, int) /root/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:306:12
    #8 0x55e590c73c97 in Imf_3_4::InputFile::Data::readPixels(int, int) /root/openexr/src/lib/OpenEXR/ImfInputFile.cpp:446:20
    #9 0x55e590c1f92f in Imf_3_4::InputFile::readPixels(int) /root/openexr/src/lib/OpenEXR/ImfInputFile.cpp:228:12
    #10 0x55e590c1f92f in Imf_3_4::InputPart::readPixels(int) /root/openexr/src/lib/OpenEXR/ImfInputPart.cpp:70:11
    #11 0x55e590c1f92f in bool Imf_3_4::(anonymous namespace)::readScanline<Imf_3_4::InputPart>(Imf_3_4::InputPart&, bool, bool) /root/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:239:20
    #12 0x55e590c1f92f in Imf_3_4::(anonymous namespace)::readMultiPart(Imf_3_4::MultiPartInputFile&, bool, bool) /root/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:879:28
    #13 0x55e590c155af in bool Imf_3_4::(anonymous namespace)::runChecks<char const*>(char const*&, bool, bool) /root/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1132:21
    #14 0x55e590c155af in Imf_3_4::checkOpenEXRFile(char const*, bool, bool, bool) /root/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1796:19
    #15 0x55e590ba5abe in exrCheck(char const*, bool, bool, bool, bool) /root/openexr/src/bin/exrcheck/main.cpp:96:16
    #16 0x55e590ba6fbe in main /root/openexr/src/bin/exrcheck/main.cpp:164:29
    #17 0x7f4259e2a1c9 in __libc_start_call_main csu/../sysdeps/npthttps://gitlab.com/qemu-project/qemu/-/issuesl/libc_start_call_main.h:58:16
    #18 0x7f4259e2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #19 0x55e590ac67d4 in _start (/root/openexr/_build_afl_asan/bin/exrcheck+0x1d87d4) (BuildId: 49c2658b2f9ddef9)

0x52500000a110 is located 752 bytes after 9504-byte region [0x525000007900,0x525000009e20)
allocated by thread T0 here:
    #0 0x55e590b61623 in malloc (/root/openexr/_build_afl_asan/bin/exrcheck+0x273623) (BuildId: 49c2658b2f9ddef9)
    #1 0x55e590db11b1 in LossyDctDecoder_execute /root/openexr/src/lib/OpenEXRCore/internal_dwa_decoder.h:324:22
    #2 0x55e590dae18d in DwaCompressor_uncompress /root/openexr/src/lib/OpenEXRCore/internal_dwa_compressor.h:1132:30
    #3 0x55e590da9960 in internal_exr_undo_dwaa /root/openexr/src/lib/OpenEXRCore/internal_dwa.c:202:18
    #4 0x55e590d42d03 in exr_uncompress_chunk /root/openexr/src/lib/OpenEXRCore/compression.c:516:14

Impact

An attacker could crash the application and in some scenarios also leak data, such as sensitive information or memory addresses that might be used to bypass exploitation mitigations like ASLR.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

Plattform	Paket	Anfällige Versionen	Behoben in
Python (PyPI)	openexr	>= 3.3.2, < 3.3.3	3.3.3

Verweise

CVSS-Wert -

CVSS-Vektor: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Schwäche (CWE): CWE-125
Plattform: Python (PyPI)
Paket: openexr
Veröffentlicht: 31.07.2025
Aktualisiert: 11.10.2026 13:19

Quellen und Lizenzen

OSV / GitHub Advisory Database - PYSEC-2026-1746 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-4r7w-q3jg-ff43 - CC BY 4.0

Schwachstellenhistorie: openexr

Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (15) im Archiv

Einträge insgesamt: 15
Erste → letzte: 05.2022 04.2026
Ohne Fix: 0
In Angriffen ausgenutzt: 0

Verteilung nach Schweregrad

Hoch 7
Mittel 7
Niedrig 1

Veröffentlichungen pro Jahr

2022: 2
2023: 0
2024: 0
2025: 4
2026: 9

08.04.2026

OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write

Hoch · 5.0 CVE-2026-34589 >= 3.2.0, < 3.2.7, >= 3.3.0, < 3.3.9, >= 3.4.0, < 3.4.9 3.2.7, 3.3.9, 3.4.9
08.04.2026

OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

Hoch · 7.8 CVE-2026-34588 >= 3.1.0, < 3.2.7, >= 3.3.0, < 3.3.9, >= 3.4.0, < 3.4.9 3.2.7, 3.3.9, 3.4.9
03.04.2026

OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)

Hoch CVE-2026-34543 >= 3.4.0, < 3.4.8, >= 3.3.0, <= 3.3.8, >= 3.2.0, <= 3.2.6 3.4.8
03.04.2026

OpenEXR: integer overflow to OOB write in uncompress_b44_impl()

Hoch CVE-2026-34544 >= 3.4.0, < 3.4.8, >= 3.3.0, <= 3.3.8, >= 3.2.0, <= 3.2.6 3.4.8
02.03.2026

OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write

Hoch CVE-2026-27622 >= 2.3.0, < 3.2.6, >= 3.3.0, < 3.3.8, >= 3.4.0, < 3.4.6 3.2.6, 3.3.8, 3.4.6
31.07.2025

OpenEXR Out of Bounds Heap Read due to Bad Pointer Arithmetic in LossyDctDecoder_execute dieser Eintrag

Mittel CVE-2025-48072 >= 3.3.2, < 3.3.3 3.3.3
31.07.2025

OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size

Hoch · 7.8 CVE-2025-48071 >= 3.3.0, < 3.3.3 3.3.3
13.05.2022

OpenEXR invalid write

Hoch · 8.8 CVE-2017-9111 < 2.2.1 2.2.1

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden