PT-2025-11562 · Cryptolib · Cryptolib

Published 2025-03-17 · Updated 2025-03-18 · CVE-2025-29910

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CryptoLib versions 1.3.3 and prior

Description A memory leak issue was identified in the crypto handle incrementing nontransmitted counter function, which can lead to resource exhaustion and degraded system performance over time. This issue is particularly concerning in long-running processes or systems that handle large volumes of data. The vulnerability is caused by the function allocating memory using malloc without ensuring the allocated memory is always freed, potentially resulting in a Denial of Service (DoS) in affected environments. Any system using CryptoLib, especially those handling high-throughput or continuous data streams, could be impacted.

Recommendations For CryptoLib versions 1.3.3 and prior, as a temporary workaround, consider restricting the use of the crypto handle incrementing nontransmitted counter function within crypto tc.c to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2025-29910

GHSA-P38W-P2R8-G6G5

Affected Products

Cryptolib

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29910.json · Exploit
• 🔥 https://github.com/nasa/CryptoLib/security/advisories/GHSA-p38w-p2r8-g6g5 · Exploit
• https://osv.dev/vulnerability/CVE-2025-29910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29910 · Security Note
• https://twitter.com/CVEnew/status/1901764121252729272 · Twitter Post
• https://twitter.com/SpaceCyberSec/status/1901936833258533280 · Twitter Post