CVE-2025-47256

Published: May 6, 2025Modified: Jun 17, 2026Deferred

5.6

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Exploitability: 1.4 / Impact: 3.7

Source: MITRE (Secondary)

Description

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Related CWEs

CWE-191

Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

References (3)

https://github.com/GCatt-AS/CVE-2025-47256

Source: cve@mitre.org

https://github.com/libxmp/libxmp/blob/ec22d1c7b93c8f681f8504a6c61c6f8a52458a10/src/loaders/prowizard/pha.c#L35

Source: cve@mitre.org

https://github.com/libxmp/libxmp/issues/847

Source: cve@mitre.org

Timeline

No history available yet.