CVE-2025-48073 — OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

Affected: AcademySoftwareFoundation openexr

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. This is fixed in version 3.3.3.

GHSA-qhpm-86v7-phmm — OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

Affected: PyPI: OpenEXR

### Summary

When reading a deep scanline image with a large sample count in `reduceMemory` mode, it is possible to crash a target application with a NULL pointer dereference in a write operation.

### Details

In the `ScanLineProcess::run_fill` function, implemented in `src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp`, the following code is used to write the `fillValue` in the sample buffer:

```cpp switch (fills.type) { case OPENEXR_IMF_INTERNAL_NAMESPACE::UINT: { unsigned int fillVal = (unsigned int) (fills.fillValue); unsigned int* fillptr = static_cast<unsigned int*> (dest);

for ( int32_t s = 0; s < samps; ++s ) fillptr[s] = fillVal; // <--- POTENTIAL CRASH HERE break; } ```

However, when `reduceMemory` mode is enabled in the `readDeepScanLine` function in `src/lib/OpenEXRUtil/ImfCheckFile.cpp`, with large sample counts, the sample data will not be read, as shown below:

```cpp // limit total number of samples read in reduceMemory mode // if (!reduceMemory || fileBufferSize + bufferSize < gMaxBytesPerDeepScanline) // <--- CHECK ON LARGE SAMPLE COUNTS AND reduceMemory { // SNIP... try { in.readPixels (y); } ```

Therefore,…

Most recent entries from all

CVE-2025-48073 — OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

GHSA-qhpm-86v7-phmm — OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode