Medium

OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

Disclosed: 31.07.2025
Updated: 11.10.2026 13:19

Summary

When reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation.

Details

In the ScanLineProcess::run_fill function, implemented in src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp, the following code is used to write the fillValue in the sample buffer:

cpp

                switch (fills.type)
                {
                    case OPENEXR_IMF_INTERNAL_NAMESPACE::UINT:
                    {
                        unsigned int fillVal = (unsigned int) (fills.fillValue);
                        unsigned int* fillptr = static_cast<unsigned int*> (dest);

                        for ( int32_t s = 0; s < samps; ++s )
                            fillptr[s] = fillVal; // <--- POTENTIAL CRASH HERE
                        break;
                    }

However, when reduceMemory mode is enabled in the readDeepScanLine function in src/lib/OpenEXRUtil/ImfCheckFile.cpp, with large sample counts, the sample data will not be read, as shown below:

cpp

            // limit total number of samples read in reduceMemory mode
            //
            if (!reduceMemory ||
                fileBufferSize + bufferSize < gMaxBytesPerDeepScanline) // <--- CHECK ON LARGE SAMPLE COUNTS AND reduceMemory
            {
            // SNIP...
            try
                {
                    in.readPixels (y);
                }

Therefore, in those cases, the sample buffer would not be allocated, resulting in a potential write operation on a NULL pointer.

PoC

NOTE: please download the runfill_crash.exr file from the following link:

https://github.com/ShielderSec/poc/tree/main/CVE-2025-48073

Compile the exrcheck binary in a macOS or GNU/Linux machine with ASAN.
Open the runfill_crash.exr file with the following command:

exrcheck -m runfill_crash.exr

Notice that exrcheck crashes with ASAN stack-trace.

Impact

An attacker may cause a denial of service by crashing the application.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	openexr	>= 3.3.2, < 3.3.3	3.3.3

References

CVSS score -

CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness (CWE): CWE-476
Platform: Python (PyPI)
Package: openexr
Disclosed: 31.07.2025
Updated: 11.10.2026 13:19

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-1748 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-qhpm-86v7-phmm - CC BY 4.0

Vulnerability history: openexr

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (15) in the archive

Total entries: 15
First → latest: 05.2022 04.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 7
Medium 7
Low 1

Disclosures per year

2022: 2
2023: 0
2024: 0
2025: 4
2026: 9

08.04.2026

OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write

High · 5.0 CVE-2026-34589 >= 3.2.0, < 3.2.7, >= 3.3.0, < 3.3.9, >= 3.4.0, < 3.4.9 3.2.7, 3.3.9, 3.4.9
08.04.2026

OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

High · 7.8 CVE-2026-34588 >= 3.1.0, < 3.2.7, >= 3.3.0, < 3.3.9, >= 3.4.0, < 3.4.9 3.2.7, 3.3.9, 3.4.9
03.04.2026

OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)

High CVE-2026-34543 >= 3.4.0, < 3.4.8, >= 3.3.0, <= 3.3.8, >= 3.2.0, <= 3.2.6 3.4.8
03.04.2026

OpenEXR: integer overflow to OOB write in uncompress_b44_impl()

High CVE-2026-34544 >= 3.4.0, < 3.4.8, >= 3.3.0, <= 3.3.8, >= 3.2.0, <= 3.2.6 3.4.8
02.03.2026

OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write

High CVE-2026-27622 >= 2.3.0, < 3.2.6, >= 3.3.0, < 3.3.8, >= 3.4.0, < 3.4.6 3.2.6, 3.3.8, 3.4.6
31.07.2025

OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode this entry

Medium CVE-2025-48073 >= 3.3.2, < 3.3.3 3.3.3
31.07.2025

OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size

High · 7.8 CVE-2025-48071 >= 3.3.0, < 3.3.3 3.3.3
13.05.2022

OpenEXR invalid write

High · 8.8 CVE-2017-9111 < 2.2.1 2.2.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application