Heap Buffer Overflow Vulnerability in Abseil-cpp

CVE-2025-0838

What is CVE-2025-0838?

A heap buffer overflow vulnerability has been identified in Abseil-cpp, specifically within the sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map}. The implementation fails to impose a limit on the size parameter, enabling malicious actors to provide excessively large values. This oversight could lead to integer overflow during the calculation of the container's backing store size, ultimately resulting in out-of-bounds memory writes. Such conditions pose significant security risks, including unauthorized access to memory segments. To mitigate this vulnerability, it is crucial to upgrade to versions beyond commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1.

References