PT-2025-47374 · Cbor2+2 · Cbor2+2

Tylzh97 · Published 2025-11-18 · Updated 2025-12-02 · CVE-2025-64076

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions cbor2 versions through 5.7.0

Description The cbor2 software contains issues in the decode definite long string() function within the C extension decoder (source/decoder.c). An integer underflow can lead to an out-of-bounds read, and a memory leak occurs due to missing reference count release. The integer underflow happens because of an incorrect variable reference and a missing state reset, causing negative values in chunk length calculations. The memory leak arises from failing to release Python object references for chunk objects in each iteration of the processing loop. These issues can be exploited remotely without authentication by sending specially crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters. Successful exploitation can lead to denial of service through process crashes or memory exhaustion.

Recommendations Update to version 5.7.1 or later.

Exploit

Fix

DoS

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

AZL-70516

CVE-2025-64076

OPENSUSE-SU-2025:20133-1

SUSE-SU-2025:21168-1

Affected Products

Debian

Suse

Cbor2

References · 21

• 🔥 https://github.com/agronholm/cbor2/issues/264 · Exploit
• https://github.com/agronholm/cbor2/commit/851473490281f82d82560b2368284ef33cf6e8f9 · Patch
• https://github.com/agronholm/cbor2/pull/265 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-64076 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:21168-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-70516 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-64076 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-64076 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-64076 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-64076 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:20133-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-64076 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64076 · Vendor Advisory
• https://github.com/agronholm/cbor2/commit/2349197bea8ebd1bf57a68f4a6549d8fd7585e66 · Note
• https://twitter.com/CVEnew/status/1991066244993417410 · Twitter Post