CVE-2025-48172

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Jul 4, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-481749.1In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size.CVE-2025-481756.5In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowByte CVE-2025-48189.8A vulnerability was found in SourceCodester Doctor's Appointment System 1.0. It has been rated as critical. This issue affects some unknown CVE-2025-481879.8RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification c CVE-2025-481885.5libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt fun CVE-2025-48193.1A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/onli CVE-2025-48205.3Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate CVE-2025-4820010.0The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.CVE-2025-482018.6The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.CVE-2025-482025.3The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-482036.4The cs_seo extension through 9.2.0 for TYPO3 allows XSS.CVE-2025-482046.8The ns_backup extension through 13.0.0 for TYPO3 allows command injection.