CVE-2025-30403

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jul 11, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-304049.8An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execuCVE-2025-304059.8An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, poCVE-2025-304069.8Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal'CVE-2025-304076.3Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (CVE-2025-304086.7Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (WindoCVE-2025-304095.5Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (WinCVE-2025-30419.8A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of theCVE-2025-304109.8Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud ACVE-2025-3041110.0Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (LiCVE-2025-3041210.0Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (LiCVE-2025-304134.4Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud AgentCVE-2025-304157.5Denial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux
CVE-2025-30403: High severity, CVSS 8.1 | Vulnix