CVE-2025-53367 Details
Description
DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.
A vulnerability has been identified in DjVuLibre versions prior to 3.5.29, specifically within the MMRDecoder::scanruns method. This out-of-bounds write vulnerability arises because the method fails to ensure that the 'xr' pointer remains within the limits of the allocated buffer. Consequently, this oversight can lead to memory corruption, creating a condition that could be exploited for arbitrary code execution. The issue was discovered through fuzzing and is particularly concerning because DjVuLibre is used by default document viewers on many Linux distributions, such as Evince and Papers. Exploitation of this vulnerability can bypass standard security protections and is demonstrated in a proof-of-concept video.
Users can upgrade to DjVuLibre version 3.5.29 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 3, 2025CISA-ADP
Assessed Jul 8, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DjVuLibre | < 3.5.29 (semver) |
CPE
Remediation
| |
| GNOME Evince | All versions |
CPE
Remediation
| |
| GNOME Papers | All versions |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2025 | CVE Modified | CVE |
| Nov 3, 2025 | CVE Modified | CVE |
| Jul 18, 2025 | CVE Modified | [email protected] |
| Jul 8, 2025 | CVE Modified | CISA-ADP |
| Jul 3, 2025 | CVE Modified | [email protected] |
| Jul 3, 2025 | New CVE Received | [email protected] |