PT-2025-25591 · Spdlog+2 · Spdlog+2

Jjleo · Published 2025-03-17 · Updated 2025-11-15 · CVE-2025-6140

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions spdlog versions up to 1.15.1

Description A problematic vulnerability was found in the spdlog library, affecting the scoped padder function in the include/spdlog/pattern formatter-inl.h library. This vulnerability leads to resource consumption and can be exploited locally. The issue has been publicly disclosed.

Recommendations For versions up to 1.15.1, upgrade to version 1.15.2 to address this issue. As a temporary workaround, consider restricting the use of the scoped padder function until the patch is applied.

Exploit

Fix

Resource Exhaustion

Improper Resource Release

Weakness Enumeration

CWE-400

CWE-404

Related Identifiers

AZL-64070

BDU:2025-11789

CVE-2025-6140

MGASA-2025-0294

OPENSUSE-SU-2025:15297-1

Affected Products

Astra Linux

Debian

Spdlog

References · 27

• 🔥 https://github.com/gabime/spdlog/issues/3360 · Exploit
• 🔥 https://github.com/gabime/spdlog/issues/3360#issuecomment-2729579422 · Exploit
• https://github.com/gabime/spdlog/releases/tag/v1.15.2 · Patch
• https://github.com/gabime/spdlog/commit/10320184df1eb4638e253a34b1eb44ce78954094 · Patch
• https://osv.dev/vulnerability/MGASA-2025-0294 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-6140 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6140 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6140 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-6140 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-6140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6140 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15297-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0294.html · Security Note
• https://bdu.fstec.ru/vul/2025-11789 · Security Note