Cloudanix VulnDB

CVE-2025-53367

None

CVSS

—

EPSS

0.9%

Published

Jul 3, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in software that reads certain document files can let someone who tricks a user into opening a bad file damage or take control of the computer.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Full Compromise
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in MMRDecoder::scanruns due to missing bounds check on xr pointer, enabling heap corruption; out-of-bounds read via pr pointer also possible.

Why it matters to the business

Applications processing DjVu files on affected systems risk crashes, memory corruption, or potential code execution when handling untrusted documents, increasing operational downtime and remediation costs.

How an attack unfolds

An attacker crafts a malicious DjVu file that triggers MMRDecoder::scanruns with an xr pointer outside the allocated buffer; the file is delivered to a victim who opens it locally, causing the OOB write and heap corruption.

How to fix it

Upgrade DjVuLibre to 3.5.29 or later; for listed Chainguard packages upgrade camunda-zeebe-8.4 and camunda-zeebe-8.4-compat to 8.4.20-r1.

How to confirm the fix worked

Verify installed DjVuLibre version is 3.5.29 or newer and confirm Chainguard packages report 8.4.20-r1; test processing of sample DjVu files for absence of crashes or memory errors.

Typical attack path

  1. Craft DjVu file that manipulates xr/pr pointers beyond buffer bounds
  2. Deliver file via email, download, or shared storage
  3. Victim opens file with affected application on local system
  4. MMRDecoder::scanruns performs out-of-bounds write resulting in heap corruption

How to detect it

Monitor application logs and crash reports for memory corruption indicators during DjVu processing; review file access logs for unexpected DjVu files from external sources.

What your security team should do

  • Immediately upgrade all affected Chainguard packages to the fixed versions
  • Inventory systems using DjVuLibre and prioritize local file-processing workflows
  • Block or sandbox untrusted DjVu files until patches are applied

The record

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 djvulibre 0 No fix
Debian:12 djvulibre 0 No fix
Debian:13 djvulibre 0 No fix
Debian:13 djvulibre 0 3.5.28-2.1
Mageia:9 djvulibre 0 3.5.29-1.mga9
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 djvulibre 0 3.5.27-150200.11.17.1
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 djvulibre 0 3.5.27-150200.11.17.1
SUSE:Linux Enterprise Module for Package Hub 15 SP6 djvulibre 0 3.5.27-150200.11.17.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7 djvulibre 0 3.5.27-150200.11.17.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 djvulibre 0 3.5.25.3-5.25.1
openSUSE:Leap 15.6 djvulibre 0 3.5.27-150200.11.17.1
openSUSE:Tumbleweed djvulibre 0 3.5.29-1.1

Related vulnerabilities