PT-2025-17936 · Z2D · Z2D

Nat3Github · CVE-2025-46333 · Published 2025-04-25 · Updated 2025-04-26

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions z2d version 0.6.0

Description The issue arises when using z2d.compositor.StrideCompositor.run to write from one surface to another, allowing the source surface to be completely out-of-bounds on the x-axis due to a negative offset. This results in an overflow of the value controlling the length of the stride. In non-safe optimization modes, such as compiling with ReleaseFast or ReleaseSmall, this could potentially lead to invalid memory accesses or corruption.

Recommendations For version 0.6.0, update to version 0.6.1 to resolve the issue. As a temporary workaround, consider avoiding the use of negative offsets when writing from one surface to another using z2d.compositor.StrideCompositor.run until the update is applied.

Exploit

Fix

Integer Overflow

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-190

CWE-122

CWE-119

Related Identifiers

CVE-2025-46333

GHSA-MM4C-P35V-7HX3

Affected Products

Z2D

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46333.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-46333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46333 · Security Note
• https://github.com/vancluever/z2d/security/advisories/GHSA-mm4c-p35v-7hx3 · Note
• https://github.com/vancluever/z2d/issues/104 · Note
• https://github.com/vancluever/z2d/issues/105 · Note
• https://twitter.com/VulmonFeeds/status/1915880998278991956 · Twitter Post
• https://t.me/cvedetector/23788 · Telegram Post
• https://twitter.com/CVEnew/status/1915871279787188694 · Twitter Post
• https://t.me/cvetracker/22405 · Telegram Post