CVE-2025-29069

What it actually does

Heap buffer overflow in UnrollChunkyBytes within cmspack.c during color space transformations, enabling memory corruption in callers of the lcms2 library.

Why it matters to the business

Risk of application instability or limited unauthorized actions in image and machine-learning pipelines that depend on the affected package; high ecosystem prevalence via downstream dependents amplifies exposure despite the supplier dispute that the root cause lies in third-party calling code rather than the library itself.

How an attack unfolds

An attacker supplies crafted image or color-profile data to a vulnerable caller that invokes the flawed unrolling routine; memory corruption occurs during transformation, though the supplier maintains the defect originates in the third-party program rather than lcms2.

How to fix it

Upgrade paddlepaddle (PyPI) to version 2.6.0 or later; no other mitigations are required once the fixed package is deployed.

How to confirm the fix worked

Confirm the installed paddlepaddle package version is 2.6.0 or newer via package manager queries and re-test color-processing workloads for absence of the overflow condition.

Typical attack path

1. Identify an application or script using the vulnerable version of the affected package
2. Craft malicious input that exercises the UnrollChunkyBytes path
3. Trigger color-space processing to overflow the heap buffer
4. Attempt to leverage resulting memory corruption for limited control or denial of service

How to detect it

Review application logs and crash reports for heap-related faults during image or color processing; correlate with paddlepaddle process activity and look for anomalous memory patterns in dependent workloads.

What your security team should do

• Prioritize upgrade of paddlepaddle to 2.6.0 across all environments
• Scan dependency graphs for any remaining pre-2.6.0 instances
• Monitor EPSS and exploit maturity indicators for changes despite current low scores