PT-2025-21225 · Unknown+1 · Pointcloudlibrary+1

Titan Team · Published 2025-05-14 · Updated 2025-05-15 · CVE-2025-4640

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L/U:Amber

Name of the Vulnerable Software and Affected Versions: PointCloudLibrary versions prior to 1.14.0

Description: The issue is an Out-of-bounds Write vulnerability in PointCloudLibrary, allowing Overflow Buffers due to a zlib issue. This vulnerability is relevant for versions older than 1.14.0 or if the user specifically requests to not use the system zlib.

Recommendations: For versions prior to 1.14.0, update to version 1.14.0 or later to mitigate the vulnerability. As a temporary workaround, consider disabling the use of the vulnerable zlib component until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the vulnerable function related to zlib until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-4640

Affected Products

Pointcloudlibrary

Zlib

References · 12

• https://github.com/PointCloudLibrary/pcl/pull/6246 · Patch
• https://cve.org/CVERecord?id=CVE-2025-4640 · Security Note
• https://ubuntu.com/security/CVE-2025-4640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4640 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4640 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-4640 · Vendor Advisory
• https://github.com/PointCloudLibrary/pcl/blob/master/surface/CMakeLists.txt#L70 · Note
• https://github.com/PointCloudLibrary/pcl/commit/502bd2b013ce635f21632d523aa8cf2e04f7b7ac · Note
• https://t.me/cvetracker/23854 · Telegram Post
• https://twitter.com/CveFindCom/status/1922721925769363654 · Twitter Post
• https://twitter.com/CVEnew/status/1922765604962042247 · Twitter Post
• https://t.me/latest_high_impact_cve/2368 · Telegram Post