CVE-2025-6271

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in swftools up to 0.9.2. This affects the function wav_convert2mono in the library lib/wav.c of the component wav2swf. The manipulation leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-119 CWE-125

Affected software

Vendor	Product	Versions
n/a	swftools	0.9.0; 0.9.1; 0.9.2

References

https://github.com/swftools/swftools/issues/239Exploit, Third Party Advisory
https://github.com/user-attachments/files/19415662/wav2swf_crash.txtExploit
https://vuldb.com/?ctiid.313275Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.313275Third Party Advisory, VDB Entry
https://vuldb.com/?submit.593005Third Party Advisory, VDB Entry
https://github.com/swftools/swftools/issues/239Exploit, Third Party Advisory

Timeline

Published: Jun 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-627105.9Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEn CVE-2025-627113.1Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm CVE-2025-627128.1JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-l CVE-2025-627137.2Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execu CVE-2025-627148.7Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.CVE-2025-627155.4ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site Scripting (XSS) vulnerabil CVE-2025-627168.1Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter a CVE-2025-627179.1Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a cl CVE-2025-627189.9Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname norma CVE-2025-627194.3LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in the FetchControl CVE-2025-62723.3A vulnerability has been found in wasm3 0.5.0 and classified as problematic. This vulnerability affects the function MarkSlotAllocated of th CVE-2025-627206.5LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire databa