Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: openexr fixed in 3.4.2-r0
AnalysisAI
OpenEXR, the high dynamic range image library, received a security fix in Alpine Linux package version 3.4.2-r0 addressing CVE-2025-48073. The specific vulnerability class and technical details have not been disclosed in available intelligence sources, limiting precise characterization of attacker capability or impact scope. EPSS scoring places exploitation probability at 0.18% (39th percentile), indicating low-to-moderate real-world exploitation interest at the time of analysis, with no public exploit code and no CISA KEV listing confirmed.
Technical ContextAI
OpenEXR is a widely used open-source high dynamic range (HDR) image file format and library originally developed by Industrial Light & Magic (ILM). It is commonly embedded in graphics pipelines, media processing tools, 3D rendering engines, and creative software suites on Linux systems, including Alpine Linux. Alpine Linux packages OpenEXR and distributes fixes via its package management system (apk). The fix is reflected in Alpine package version 3.4.2-r0. No CWE identifier has been assigned in available data, so the root cause class - whether memory corruption, improper input validation, integer overflow in image parsing, or another category - cannot be confirmed from current intelligence. Vulnerabilities in image parsing libraries often involve malformed or crafted image files triggering unsafe memory operations.
Affected ProductsAI
The affected product is OpenEXR as packaged in Alpine Linux, with the fix shipping in Alpine package version 3.4.2-r0. The specific upstream OpenEXR library version corresponding to this Alpine package is not confirmed in available data. Alpine Linux is the sole reporting source (vendor:alpine). No CPE strings are available in the provided intelligence. Other Linux distributions or platforms packaging OpenEXR may also be affected, but cross-distribution impact has not been assessed in available data. Users should consult the Alpine Linux security tracker and the upstream OpenEXR project advisories for authoritative affected version ranges.
RemediationAI
The primary remediation is to update the OpenEXR package on Alpine Linux to version 3.4.2-r0 or later using the Alpine package manager (apk upgrade openexr). Users running Alpine Linux with OpenEXR installed should apply this update promptly. No upstream OpenEXR advisory URL or vendor security bulletin was included in available intelligence, so users should monitor the Alpine Linux security advisories at https://security.alpinelinux.org and the upstream OpenEXR GitHub repository for additional guidance. If immediate patching is not possible and OpenEXR is used to process untrusted image files, a compensating control is to restrict or disable processing of externally sourced EXR files until the patch is applied, accepting the trade-off of reduced functionality. No specific workarounds have been confirmed by the vendor in available data.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today