CVE-2025-55286

{"id": "CVE-2025-55286", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-16T01:15:27.567", "references": [{"url": "https://github.com/vancluever/z2d/commit/93e45d36af53cda0d7f454ed8440713b7ac155b6", "source": "security-advisories@github.com"}, {"url": "https://github.com/vancluever/z2d/pull/137", "source": "security-advisories@github.com"}, {"url": "https://github.com/vancluever/z2d/security/advisories/GHSA-2vq8-cp8r-vcf3", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "z2d is a pure Zig 2D graphics library. z2d v0.7.0 released with a new multi-sample anti-aliasing (MSAA) method, which uses a new buffering mechanism for storing coverage data. This differs from the standard alpha mask surface used for the previous super-sample anti-aliasing (SSAA) method. Under certain circumstances where the path being drawn existed in whole or partly outside of the rendering surface, incorrect bounding could cause out-of-bounds access within the coverage buffer. This affects the higher-level drawing operations, such as Context.fill, Context.stroke, painter.fill, and painter.stroke, when either the .default or .multisample_4x anti-aliasing modes were used. .supersample_4x was not affected, nor was drawing without anti-aliasing. In non-safe optimization modes (consumers compiling with ReleaseFast or ReleaseSmall), this could potentially lead to invalid memory accesses or corruption. z2d v0.7.1 fixes this issue, and it's recommended to upgrade to v0.7.1, or, given the small period of time v0.7.0 has been released, use v0.7.1 immediately, skipping v0.7.0."}, {"lang": "es", "value": "z2d es una librer\u00eda de gr\u00e1ficos Zig 2D pura. z2d v0.7.0 se lanz\u00f3 con un nuevo m\u00e9todo de antialiasing multimuestra (MSAA), que utiliza un nuevo mecanismo de almacenamiento en b\u00fafer para almacenar datos de cobertura. Esto difiere de la superficie de m\u00e1scara alfa est\u00e1ndar utilizada para el m\u00e9todo anterior de antialiasing de supermuestra (SSAA). En ciertas circunstancias, cuando la ruta dibujada se encontraba total o parcialmente fuera de la superficie de renderizado, una delimitaci\u00f3n incorrecta pod\u00eda provocar un acceso fuera de los l\u00edmites dentro del b\u00fafer de cobertura. Esto afecta a las operaciones de dibujo de alto nivel, como Context.fill, Context.stroke, painter.fill y painter.stroke, cuando se utilizaban los modos de antialiasing .default o .multisample_4x. .supersample_4x no se vio afectado, ni tampoco el dibujo sin antialiasing. En modos de optimizaci\u00f3n no seguros (consumidores que compilan con ReleaseFast o ReleaseSmall), esto podr\u00eda provocar accesos no v\u00e1lidos a la memoria o corrupci\u00f3n. z2d v0.7.1 corrige este problema y se recomienda actualizar a v0.7.1 o, dado el peque\u00f1o per\u00edodo de tiempo desde que se lanz\u00f3 v0.7.0, usar v0.7.1 inmediatamente y omitir v0.7.0."}], "lastModified": "2025-08-18T20:16:28.750", "sourceIdentifier": "security-advisories@github.com"}