Uninitialized Pointer Vulnerability in libzvbi Affecting Multiple Versions
CVE-2025-2173

6.9MEDIUM

Key Information:

Vendor

zapping-vbi

Status
Libzvbi
Vendor
CVE Published:
11 March 2025

What is CVE-2025-2173?

A vulnerability exists in libzvbi up to version 0.2.43, specifically within the function vbi_strndup_iconv_ucs2 in the source file src/conv.c. This flaw results from improper handling of the src_length argument, leading to the potential use of uninitialized pointers. Given that the issue can be exploited remotely, it poses a tangible risk to users. The security flaw has been publicly disclosed, and it is strongly recommended that users upgrade to version 0.2.44 or later to mitigate this issue. The patch addressing this vulnerability has been documented as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce, and swift action has been taken by the code maintainer to rectify the situation.

Affected Version(s)

libzvbi 0.2.0

libzvbi 0.2.1

libzvbi 0.2.2

References

https://vuldb.com/?id.299202
vdb-entrytechnical-description
https://vuldb.com/?ctiid.299202
signaturepermissions-required
https://vuldb.com/?submit.512798
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ninpwn (VulDB User)
.