CVE-2025-62813
Medium · 5.9CVSS
5.9
EPSS
—
Published
Oct 23, 2025
CISA due date
—
The record
LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | coreboot-utils | 0 | 25.09-2.1 |
| openSUSE:Tumbleweed | mozjs115 | 0 | 115.15.0-6.1 |
| openSUSE:Tumbleweed | mozjs128 | 0 | 128.14.0-2.1 |
| openSUSE:Tumbleweed | mozjs140 | 0 | 140.4.0-2.1 |
Related vulnerabilities
- CVE-2025-70103 Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the… Also affects mozjs115
- CVE-2026-32776 libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter… Also affects mozjs115
- CVE-2026-32777 libexpat before 2.7.5 allows an infinite loop while parsing DTD content. Also affects mozjs115
- CVE-2026-32778 libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on… Also affects mozjs115
- CVE-2024-56431 oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an… Also affects mozjs115
- CVE-2024-11498 There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the… Also affects mozjs115
- CVE-2024-11403 There exists an out of bounds read/write in LibJXL versions prior to commit… Also affects mozjs115
- CVE-2024-45492 An issue was discovered in libexpat before 2.6.3. Also affects mozjs115