CVE-2025-48498

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A null pointer dereference vulnerability exists in the Distributed Transaction component of Bloomberg Comdb2 8.1 when processing a number of fields used for coordination. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-484995.3Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (CVE-2025-48506.3A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of CVE-2025-485007.3A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker CVE-2025-485019.3An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS comman CVE-2025-485025.5Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial o CVE-2025-485037.8A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in CVE-2025-485051.0Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged e CVE-2025-485064.6Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, CVE-2025-485078.6The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors acces CVE-2025-485086.0Improper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual machine to control CVE-2025-485091.8Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of CVE-2025-48519.8A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUs