PT-2025-27837 · Djvulibre+6 · Djvulibre+6

Published 2025-07-01 · Updated 2026-02-23 · CVE-2025-53367

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DjVuLibre versions prior to 3.5.29 djvulibre versions prior to 3.5.28-2.1~deb12u1 mingw-djvulibre version 3.5.29 djview versions prior to 3.5.28-2ubuntu0.25.04.1 djview3 versions prior to 3.5.28-2ubuntu0.25.04.1 djvulibre-bin versions prior to 3.5.28-2ubuntu0.25.04.1 djvulibre-desktop versions prior to 3.5.28-2ubuntu0.25.04.1 djvuserve versions prior to 3.5.28-2ubuntu0.25.04.1 libdjvulibre-dev versions prior to 3.5.28-2ubuntu0.25.04.1 libdjvulibre-text versions prior to 3.5.28-2ubuntu0.25.04.1 libdjvulibre21 versions prior to 3.5.28-2ubuntu0.25.04.1

Description DjVuLibre is susceptible to an out-of-bounds write vulnerability within the MMRDecoder::scanruns method. This occurs because the code does not validate that the xr pointer remains within the allocated buffer boundaries. This can lead to memory corruption and potentially allow for remote code execution when processing specially crafted DjVu documents. The vulnerability can also result in out-of-bounds reads. The issue affects systems using DjVuLibre, including those that automatically detect DjVu documents with a .pdf extension, such as Evince and Papers.

Recommendations Update to DjVuLibre version 3.5.29 or later. Update djvulibre to version 3.5.28-2.1~deb12u1 or later. Update mingw-djvulibre to version 3.5.29 or later. Update djview to version 3.5.28-2ubuntu0.25.04.1 or later. Update djview3 to version 3.5.28-2ubuntu0.25.04.1 or later. Update djvulibre-bin to version 3.5.28-2ubuntu0.25.04.1 or later. Update djvulibre-desktop to version 3.5.28-2ubuntu0.25.04.1 or later. Update djvuserve to version 3.5.28-2ubuntu0.25.04.1 or later. Update libdjvulibre-dev to version 3.5.28-2ubuntu0.25.04.1 or later. Update libdjvulibre-text to version 3.5.28-2ubuntu0.25.04.1 or later. Update libdjvulibre21 to version 3.5.28-2ubuntu0.25.04.1 or later. Run sudo pro fix USN-7631-1 to fix the vulnerability.

Exploit

Fix

RCE

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

BDU:2025-11247

CVE-2025-53367

DLA-4247-1

DSA-5960-1

MGASA-2025-0209

OESA-2025-1756

OPENSUSE-SU-2025:15319-1

SUSE-SU-2025:02695-1

SUSE-SU-2025:02703-1

SUSE-SU-2025_02695-1

SUSE-SU-2025_02703-1

USN-7631-1

USN-8054-1

Affected Products

Astra Linux

Debian

Djvulibre

Linuxmint

Red Os

Suse

Ubuntu

References · 70

• 🔥 https://github.com/github/securitylab/tree/main/SecurityExploits/DjVuLibre/MMRDecoder_scanruns_CVE-2025-53367 · Exploit
• 🔥 https://github.blog/security/vulnerability-research/cve-2025-53367-an-exploitable-out-of-bounds-write-in-djvulibre · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53367 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:02703-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02695-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15319-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5960-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0209.html · Security Note
• https://ubuntu.com/security/notices/USN-7631-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-53367 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-53367 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8054-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-53367 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53367 · Vendor Advisory