PT-2025-18039 · Unknown · Scipopt Scip

Micromilo · CVE-2025-4001 · Published 2025-04-28 · Updated 2025-04-28

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions scipopt scip versions up to 9.2.1

Description A vulnerability has been found in the function main of the file examples/LOP/src/genRandomLOPInstance.c of the component File Descriptor Handler. The manipulation of the argument File leads to uncontrolled file descriptor consumption. Local access is required to approach this attack.

Recommendations For scipopt scip versions up to 9.2.1, upgrade to version 9.2.2 to address this issue. As a temporary workaround, consider restricting access to the vulnerable component File Descriptor Handler until the upgrade is applied.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-769

Related Identifiers

CVE-2025-4001

Affected Products

Scipopt Scip

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4001.json · Exploit
• https://github.com/scipopt/scip/releases/tag/v922 · Patch
• https://github.com/scipopt/scip/commit/d6da63b941216d75fbc1aefea9abf1de6712a2d0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-4001 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4001 · Vendor Advisory
• https://github.com/scipopt/scip/issues/130 · Note
• https://github.com/scipopt/scip/issues/130#issuecomment-2697893742 · Note
• https://vuldb.com/?id.306337 · Note
• https://twitter.com/CVEnew/status/1916718854195367950 · Twitter Post
• https://vuldb.com/?ctiid.306337 · Note
• https://vuldb.com/?submit.558121 · Note
• https://t.me/cvedetector/23889 · Telegram Post
• https://t.me/cvenotify/119996 · Telegram Post
• https://t.me/cvetracker/22498 · Telegram Post