CVE-2025-0838 Details
Description
There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1
A heap buffer overflow vulnerability has been identified in Abseil-cpp, specifically within the sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map}. These methods did not enforce a maximum limit on the size parameter, allowing callers to input excessively large sizes. This oversight could lead to an integer overflow when calculating the size of the container's backing store, followed by an out-of-bounds memory write. Additionally, subsequent accesses to the container could reach out-of-bounds memory, potentially causing further issues.
Users are advised to upgrade to version 0~20200923.3-2+deb11u1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 21, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2025/04/msg00012.html | CVE | Mailing ListThird Party Advisory |
| https://github.com/abseil/abseil-cpp/commit/5a0e2cb5e3958dd90bb8569a2766622cb74d90c1 | [email protected] | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| abseil common libraries | < 20250127.0 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2025 | Initial Analysis | [email protected] |
| Apr 5, 2025 | CVE Modified | CVE |
| Feb 21, 2025 | New CVE Received | [email protected] |