CVE-2025-4948

HIGH Year: 2025
CVSS v3 Score
7.5
High
Weakness Type
CWE-191
View all →

Vulnerability Description

A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messages. Due to improper validation, an internal calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid memory and crash. As a result, any application or server using libsoup could be forced to exit unexpectedly, creating a denial-of-service (DoS) risk.

Related Vulnerabilities

CVE-2004-0816

HIGH
CVSS:7.5(High)

Integer underflow in the firewall logging rules for iptables in Linux before 2.6.8 allows remote attackers to cause a denial of service (application crash) via a malformed IP packet.

CWE-1912004

CVE-2004-1002

HIGH
CVSS:7.5(High)

Integer underflow in pppd in cbcp.c for ppp 2.4.1 allows remote attackers to cause a denial of service (daemon crash) via a CBCP packet with an invalid length value that causes pppd to access an incor...

CWE-1912004

CVE-2005-1891

HIGH
CVSS:7.5(High)

The GIF parser in ateimg32.dll in AOL Instant Messenger (AIM) 5.9.3797 and earlier allows remote attackers to cause a denial of service (crash) via a malformed buddy icon that causes an integer underf...

CWE-1912005

CVE-2011-1770

HIGH
CVSS:7.5(High)

Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel before 2.6.33.14 allows remote attackers to cause a denial of service via a Datagram Congestion Control Pr...

CWE-1912011

CVE-2017-14496

HIGH
CVSS:7.5(High)

Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service v...

CWE-1912017

CVE-2018-12230

HIGH
CVSS:7.5(High)

An wrong logical check identified in the transferFrom function of a smart contract implementation for RemiCoin (RMC), an Ethereum ERC20 token, allows the attacker to steal tokens or conduct resultant ...

CWE-1912018