Integer Overflow Vulnerability in libzvbi Affects Remote Functionality
CVE-2025-2176

6.9MEDIUM

Key Information:

Vendor

zapping-vbi

Status
Libzvbi
Vendor
CVE Published:
11 March 2025

What is CVE-2025-2176?

A recently discovered vulnerability in libzvbi versions up to 0.2.43 allows an integer overflow in the vbi_capture_sim_load_caption function, located in src/io-sim.c. This flaw can be exploited by attackers remotely, potentially compromising the function's integrity. The issue has been publicly disclosed, indicating the necessity for awareness and prompt action among users. To mitigate this risk, it is crucial to upgrade to version 0.2.44, which includes a patch addressing this specific vulnerability.

Affected Version(s)

libzvbi 0.2.0

libzvbi 0.2.1

libzvbi 0.2.2

References

https://vuldb.com/?id.299205
vdb-entrytechnical-description
https://vuldb.com/?ctiid.299205
signaturepermissions-required
https://vuldb.com/?submit.512802
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ninpwn (VulDB User)
.