CVE-2025-64076
Apache cbor2 Integer Underflow and Memory Leak
Description
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds Read (CWE-191, CWE-125): An incorrect variable reference and missing state reset in the chunk processing loop causes buffer_length to not be reset to zero after UTF-8 character consumption. This results in subsequent chunk_length calculations producing negative values (e.g., chunk_length = 65536 - buffer_length), which are passed as signed integers to the read() method, potentially triggering unlimited read operations and resource exhaustion. (2) Memory Leak via Missing Reference Count Release (CWE-401): The main processing loop fails to release Python object references (Py_DECREF) for chunk objects allocated in each iteration. For CBOR strings longer than 65536 bytes, this causes cumulative memory leaks proportional to the payload size, enabling memory exhaustion attacks through repeated processing of large CBOR payloads. Both vulnerabilities can be exploited remotely without authentication by sending specially-crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters positioned at 65536-byte chunk boundaries. Successful exploitation results in denial of service through process crashes (CBORDecodeEOF exceptions) or memory exhaustion. The vulnerabilities affect all applications using cbor2's C extension to process untrusted CBOR data, including web APIs, IoT data collectors, and message queue processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8f9 pushed with released version 5.7.1.
INFO
Published Date :
Nov. 18, 2025, 6:16 p.m.
Last Modified :
Nov. 5, 2026, 2:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update the cbor2 library to version 5.7.1.
- Apply patches if updating is not feasible.
- Monitor system resources for memory usage.
- Validate CBOR data integrity before processing.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-64076.
| URL | Resource |
|---|---|
| https://github.com/agronholm/cbor2/commit/851473490281f82d82560b2368284ef33cf6e8f9 | Patch |
| https://github.com/agronholm/cbor2/issues/264 | Exploit Issue Tracking |
| https://github.com/agronholm/cbor2/pull/265 | Exploit Issue Tracking Patch |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-64076 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-64076
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-64076 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-64076 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Nov. 05, 2026
Action Type Old Value New Value Added Translation Title: Through de Cbor2, Description: Múltiples vulnerabilidades existen en cbor2 hasta la versión 5.7.0 en la función decode_definite_long_string() del decodificador de la extensión C (source/decoder.c): (1) Desbordamiento negativo de enteros (Integer Underflow) que conduce a lectura fuera de límites (Out-of-Bounds Read) (CWE-191, CWE-125): Una referencia de variable incorrecta y una falta de reinicio de estado en el bucle de procesamiento de fragmentos hacen que buffer_length no se reinicie a cero después del consumo de caracteres UTF-8. Esto resulta en que los cálculos subsiguientes de chunk_length produzcan valores negativos (p. ej., chunk_length = 65536 - buffer_length), los cuales se pasan como enteros con signo al método read(), lo que podría desencadenar operaciones de lectura ilimitadas y agotamiento de recursos. (2) Fuga de memoria por falta de liberación del contador de referencias (Memory Leak via Missing Reference Count Release) (CWE-401): El bucle de procesamiento principal no libera referencias de objetos Python (Py_DECREF) para los objetos de fragmento asignados en cada iteración. Para cadenas CBOR de más de 65536 bytes, esto causa fugas de memoria acumulativas proporcionales al tamaño de la carga útil, lo que permite ataques de agotamiento de memoria mediante el procesamiento repetido de grandes cargas útiles CBOR. Ambas vulnerabilidades pueden ser explotadas remotamente sin autenticación enviando datos CBOR especialmente diseñados que contengan cadenas de texto de longitud definida con caracteres UTF-8 multibyte posicionados en los límites de fragmentos de 65536 bytes. La explotación exitosa resulta en denegación de servicio a través de fallos de proceso (excepciones CBORDecodeEOF) o agotamiento de memoria. Las vulnerabilidades afectan a todas las aplicaciones que utilizan la extensión C de cbor2 para procesar datos CBOR no confiables, incluyendo APIs web, recolectores de datos IoT y procesadores de colas de mensajes. Corregido en el commit 851473490281f82d82560b2368284ef33cf6e8f9 publicado con la versión 5.7.1. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'n/a', 'product': 'n/a', 'versions': [{'status': 'affected', 'version': 'n/a'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-64076', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2025-11-19T13:54:52.352278Z'} -
Initial Analysis by [email protected]
Dec. 31, 2025
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:agronholm:cbor2:*:*:*:*:*:python:*:* versions up to (including) 5.7.0 Added Reference Type MITRE: https://github.com/agronholm/cbor2/commit/851473490281f82d82560b2368284ef33cf6e8f9 Types: Patch Added Reference Type MITRE: https://github.com/agronholm/cbor2/issues/264 Types: Exploit, Issue Tracking Added Reference Type MITRE: https://github.com/agronholm/cbor2/pull/265 Types: Exploit, Issue Tracking, Patch -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Nov. 19, 2025
Action Type Old Value New Value Added CWE CWE-191 -
New CVE Received by [email protected]
Nov. 18, 2025
Action Type Old Value New Value Added Description Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds Read (CWE-191, CWE-125): An incorrect variable reference and missing state reset in the chunk processing loop causes buffer_length to not be reset to zero after UTF-8 character consumption. This results in subsequent chunk_length calculations producing negative values (e.g., chunk_length = 65536 - buffer_length), which are passed as signed integers to the read() method, potentially triggering unlimited read operations and resource exhaustion. (2) Memory Leak via Missing Reference Count Release (CWE-401): The main processing loop fails to release Python object references (Py_DECREF) for chunk objects allocated in each iteration. For CBOR strings longer than 65536 bytes, this causes cumulative memory leaks proportional to the payload size, enabling memory exhaustion attacks through repeated processing of large CBOR payloads. Both vulnerabilities can be exploited remotely without authentication by sending specially-crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters positioned at 65536-byte chunk boundaries. Successful exploitation results in denial of service through process crashes (CBORDecodeEOF exceptions) or memory exhaustion. The vulnerabilities affect all applications using cbor2's C extension to process untrusted CBOR data, including web APIs, IoT data collectors, and message queue processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8f9 pushed with released version 5.7.1. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added Reference https://github.com/agronholm/cbor2/commit/851473490281f82d82560b2368284ef33cf6e8f9 Added Reference https://github.com/agronholm/cbor2/issues/264 Added Reference https://github.com/agronholm/cbor2/pull/265