CVE-2025-15564

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The manipulation leads to divide by zero. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-369 CWE-404

Affected software

Vendor	Product	Versions
n/a	Mapnik	4.0; 4.1; 4.2.0

References

https://github.com/mapnik/mapnik/Product
https://github.com/mapnik/mapnik/issues/4545Exploit, Issue Tracking
https://github.com/oneafter/1219/blob/main/reproExploit
https://vuldb.com/?ctiid.344502Permissions Required, VDB Entry
https://vuldb.com/?id.344502Third Party Advisory, VDB Entry
https://vuldb.com/?submit.743386Third Party Advisory, VDB Entry

Timeline

Published: Feb 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-155655.3The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect fu CVE-2025-155668.8A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be us CVE-2025-155673.3Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.CVE-2025-155688.0A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacen CVE-2025-155697.0A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11 CVE-2025-15574.3A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to c CVE-2025-155707.8A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a ma CVE-2025-155715.5A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file st CVE-2025-155725.5A vulnerability has been found in wasm3 up to 0.5.0. The affected element is the function NewCodePage. The manipulation leads to memory leak CVE-2025-155739.4The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqt CVE-2025-155746.5When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the So CVE-2025-155755.3The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash mal