CVE-2025-48072: OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap

Summary The OpenEXRCore code is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk.

Details

In the LossyDctDecoderexecute function (from src/lib/OpenEXRCore/internaldwadecoder.h, when SSE2 is enabled), the following code is used to copy data from the chunks:

cpp // no-op conversion to linear for (int y = 8 blocky; y < 8 blocky + maxY; ++y) { m128i restrict dst = (m128i ) chanData[comp]->rows[y]; m128i const restrict src = (m128i const )&rowBlock[comp][(y & 0x7) 8];

for (int blockx = 0; blockx < numFullBlocksX; ++blockx) { mmstoreusi128 (dst, mmloadusi128 (src)); //

src += 8 8; // <--- si128 pointer incremented as a uint16t dst += 8; } }

The issue arises because the src pointer, which is a si128 pointer, is incremented by 88, as if it were a uint16t pointer (64 uint16t == 128 bytes). In non-block aligned chunks (width/height not a multiple of 8), this can cause src to point past the boundaries of the chunk.

PoC

In order to reproduce the PoC with fidelity and avoid undefined behaviors, it is necessary to enable ASAN (and SSE2). Otherwise the out-of-bound read will not be detected until its side-effect causes a crash.

NOTE: please download the dwadecodercrash.exr file from the following link:

https://github.com/ShielderSec/poc/tree/main/CVE-2025-48072

1. Compile the exrcheck binary in a macOS or GNU/Linux machine with ASAN. 2. Open the dwadecodercrash.exr file with the following command:

exrcheck dwadecodercrash.exr

3. Notice that exrcheck crashes with ASAN stack-trace.

==2297956==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x52500000a110 at pc 0x55e590db7bf1 bp 0x7fff948bb110 sp 0x7fff948bb108 READ of size 16 at 0x52500000a110 thread T0 #0 0x55e590db7bf0 in LossyDctDecoderexecute /root/openexr/src/lib/OpenEXRCore/internaldwadecoder.h:650:48 #1 0x55e590dae18d in DwaCompressoruncompress /root/openexr/src/lib/OpenEXRCore/internaldwacompressor.h:1132:30 #2 0x55e590da9960 in internalexrundodwaa /root/openexr/src/lib/OpenEXRCore/internaldwa.c:202:18 #3 0x55e590d42d03 in exruncompresschunk /root/openexr/src/lib/OpenEXRCore/compression.c:516:14 #4 0x55e590dc3132 in exrdecodingrun /root/openexr/src/lib/OpenEXRCore/decoding.c:580:14 #5 0x55e590c7d78f in Imf34::(anonymous namespace)::ScanLineProcess::rundecode(privexrcontextt const, int, Imf34::FrameBuffer const, int, int, std::vector<Imf34::Slice, std::allocator<Imf34::Slice>> const&) /root/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:585:23 #6 0x55e590c83ed7 in Imf34::ScanLineInputFile::Data::readPixels(Imf34::FrameBuffer const&, int, int) /root/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:499:21 #7 0x55e590c73c97 in Imf34::ScanLineInputFile::readPixels(int, int) /root/openexr/src/lib/OpenEXR/ImfScanLineInputFile.cpp:306:12 #8 0x55e590c73c97 in Imf34::InputFile::Data::readPixels(int, int) /root/openexr/src/lib/OpenEXR/ImfInputFile.cpp:446:20 #9 0x55e590c1f92f in Imf34::InputFile::readPixels(int) /root/openexr/src/lib/OpenEXR/ImfInputFile.cpp:228:12 #10 0x55e590c1f92f in Imf34::InputPart::readPixels(int) /root/openexr/src/lib/OpenEXR/ImfInputPart.cpp:70:11 #11 0x55e590c1f92f in bool Imf34::(anonymous namespace)::readScanline<Imf34::InputPart>(Imf34::InputPart&, bool, bool) /root/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:239:20 #12 0x55e590c1f92f in Imf34::(anonymous namespace)::readMultiPart(Imf34::MultiPartInputFile&, bool, bool) /root/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:879:28 #13 0x55e590c155af in bool Imf34::(anonymous namespace)::runChecks<char const>(char const&, bool, bool) /root/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1132:21 #14 0x55e590c155af in Imf34::checkOpenEXRFile(char const, bool, bool, bool) /root/openexr/src/lib/OpenEXRUtil/ImfCheckFile.cpp:1796:19 #15 0x55e590ba5abe in exrCheck(char const, bool, bool, bool, bool) /root/openexr/src/bin/exrcheck/main.cpp:96:16 #16 0x55e590ba6fbe in main /root/openexr/src/bin/exrcheck/main.cpp:164:29 #17 0x7f4259e2a1c9 in libcstartcallmain csu/../sysdeps/npthttps://gitlab.com/qemu-project/qemu/-/issuesl/libcstartcallmain.h:58:16 #18 0x7f4259e2a28a in libcstartmain csu/../csu/libc-start.c:360:3 #19 0x55e590ac67d4 in start (/root/openexr/buildaflasan/bin/exrcheck+0x1d87d4) (BuildId: 49c2658b2f9ddef9)

0x52500000a110 is located 752 bytes after 9504-byte region [0x525000007900,0x525000009e20) allocated by thread T0 here: #0 0x55e590b61623 in malloc (/root/openexr/buildaflasan/bin/exrcheck+0x273623) (BuildId: 49c2658b2f9ddef9) #1 0x55e590db11b1 in LossyDctDecoderexecute /root/openexr/src/lib/OpenEXRCore/internaldwadecoder.h:324:22 #2 0x55e590dae18d in DwaCompressoruncompress /root/openexr/src/lib/OpenEXRCore/internaldwacompressor.h:1132:30 #3 0x55e590da9960 in internalexrundodwaa /root/openexr/src/lib/OpenEXRCore/internaldwa.c:202:18 #4 0x55e590d42d03 in exruncompresschunk /root/openexr/src/lib/OpenEXRCore/compression.c:516:14

Impact An attacker could crash the application and in some scenarios also leak data, such as sensitive information or memory addresses that might be used to bypass exploitation mitigations like ASLR.