CVE-2025-52456

{"id": "CVE-2025-52456", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-08-25T15:15:40.410", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2224", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-680"}]}], "descriptions": [{"lang": "en", "value": "A memory corruption vulnerability exists in the WebP Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .webp animation an integer overflow can be made to occur when calculating the stride for decoding. Afterwards, this will cause a heap-based buffer to overflow when decoding the image which can lead to remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad de corrupci\u00f3n de memoria en la funci\u00f3n WebP Image Decoding de SAIL Image Decoding Library v0.9.8. Al cargar una animaci\u00f3n .webp especialmente manipulada, se puede producir un desbordamiento de enteros al calcular el paso de decodificaci\u00f3n. Esto provoca un desbordamiento del b\u00fafer del mont\u00f3n al decodificar la imagen, lo que puede provocar la ejecuci\u00f3n remota de c\u00f3digo. Un atacante deber\u00e1 convencer a la librer\u00eda para que lea un archivo para activar esta vulnerabilidad."}], "lastModified": "2025-09-02T17:13:42.960", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sail:sail:0.9.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDFCF91A-2A3D-45C6-A8C3-DD90A646BDAA"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}