Heap-based Buffer Overflow in Mintty Image Parsing
CVE-2025-1052

8.8HIGH

Key Information:

Vendor

Mintty

Status
Mintty
Vendor
CVE Published:
11 February 2025

What is CVE-2025-1052?

This vulnerability in Mintty is due to improper validation during the parsing of sixel images. It allows remote attackers to execute arbitrary code by enticing users to visit a malicious webpage or open a harmful file. The flaw occurs when user-supplied data is copied to a heap-based buffer without adequate length checks, potentially enabling an attacker to act within the context of the current user. This vulnerability highlights the importance of stringent data validation in preventing exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Mintty 3.7.1 (Git-2.45.1-64-bit.exe)

References

https://www.zerodayinitiative.com/advisories/ZDI-25-084/
x_research-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.