CVE-2025-4638

CRITICAL

9.8

Description

A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-dependent attackers to cause undefined behavior by exploiting improper pointer arithmetic. Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITH_SYSTEM_ZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie5/14/2025

Derniere modification10/21/2025

Sourcenvd

Observations honeypot0

Produits affectes

pointclouds:point_cloud_library

Faiblesses (CWE)

CWE-119

References

https://github.com/PointCloudLibrary/pcl/blob/master/surface/CMakeLists.txt#L70(cve_disclosure@tech.gov.sg)

https://github.com/PointCloudLibrary/pcl/commit/502bd2b013ce635f21632d523aa8cf2e04f7b7ac(cve_disclosure@tech.gov.sg)

https://github.com/PointCloudLibrary/pcl/pull/6245(cve_disclosure@tech.gov.sg)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.