CVE-2025-53367

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.

Metrics

CVSS 4.0 8.4/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-125 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jul 3, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-533685.4Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions ar CVE-2025-533698.6Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not prope CVE-2025-53375.4The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ param CVE-2025-533705.4Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions s CVE-2025-533719.1DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotificatio CVE-2025-533727.5node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaS CVE-2025-533738.9Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the CVE-2025-533744.3Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An auth CVE-2025-533756.5Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An auth CVE-2025-533768.8Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An auth CVE-2025-533776.1WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_depe CVE-2025-533789.8A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthentica