CVE-2025-4638

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-4638

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

A

vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-dependent attackers to cause undefined behavior by exploiting improper pointer arithmetic. Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITH_SYSTEM_ZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib.

References
Link Resource
https://github.com/PointCloudLibrary/pcl/blob/master/surface/CMakeLists.txt#L70 Product
https://github.com/PointCloudLibrary/pcl/commit/502bd2b013ce635f21632d523aa8cf2e04f7b7ac Patch
https://github.com/PointCloudLibrary/pcl/pull/6245 Issue Tracking Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:pointclouds:point_cloud_library:*:*:*:*:*:*:*:*
History

21 Oct 2025, 14:10

Type Values Removed Values Added
References () https://github.com/PointCloudLibrary/pcl/blob/master/surface/CMakeLists.txt#L70 - () https://github.com/PointCloudLibrary/pcl/blob/master/surface/CMakeLists.txt#L70 - Product
References () https://github.com/PointCloudLibrary/pcl/commit/502bd2b013ce635f21632d523aa8cf2e04f7b7ac - () https://github.com/PointCloudLibrary/pcl/commit/502bd2b013ce635f21632d523aa8cf2e04f7b7ac - Patch
References () https://github.com/PointCloudLibrary/pcl/pull/6245 - () https://github.com/PointCloudLibrary/pcl/pull/6245 - Issue Tracking, Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:a:pointclouds:point_cloud_library:*:*:*:*:*:*:*:*
First Time Pointclouds
Pointclouds point Cloud Library

16 May 2025, 14:43

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad en el componente inftrees.c de la librería zlib, que se incluye en PointCloudLibrary (PCL). Este problema podría permitir que atacantes dependientes del contexto provoquen un comportamiento indefinido al explotar una aritmética de punteros incorrecta. Desde la versión 1.14.0, PCL utiliza de forma predeterminada una instalación de zlib desde el sistema, a menos que el usuario configure WITH_SYSTEM_ZLIB=FALSE. Por lo tanto, esta posible vulnerabilidad solo es relevante si la versión de PCL es anterior a la 1.14.0 o si el usuario solicita específicamente no usar la zlib del sistema.

15 May 2025, 14:15

Type Values Removed Values Added
CWE CWE-119

14 May 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-14 18:15

Updated : 2025-10-21 14:10

NVD link : CVE-2025-4638

Mitre link : CVE-2025-4638

CVE.ORG link : CVE-2025-4638

JSON object : View

Products Affected

pointclouds

CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer