CVE-2025-48172 json
CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow.
published last yr. modified 4mo ago also EUVD-2025-20018
- cvss
- 5.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 7%
- public exploits
- 0
- none known
Summary
CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.
Patch / fix
- chmlib openSUSE Tumbleweed 0.40-26.1
opensuse advisories openSUSE-SU-2025:15326-1
Is CVE-2025-48172 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- drive.google.com https://drive.google.com/file/d/1XpulFyCGlq7Szzg5RsH-eRwZ6OyuSozl/view?usp=sharing referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.6 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L |
Affected products
- CHMLib CHMLib
Classification
- Weakness
-
- CWE-190 Integer Overflow or Wraparound
References
- github.com /sumatrapdfreader/sumatrapdf/commit/08179946a745cf1605e4b9670942ec1a6e1f4c5d
-
drive.google.com
/file/d/1XpulFyCGlq7Szzg5RsH-eRwZ6OyuSozl/view?usp=sharing
exploit
- drive.google.com /file/d/1wq51px42eoJz2VQ1Qu9ObPVQVom9T9H_/view?usp=sharing
- github.com /jedwing/CHMLib/blob/2bef8d063ec7d88a8de6fd9f0513ea42ac0fa21f/src/chm_lib.c#L1386
Sources
- CVE List CVE-2025-48172
- NVD CVE-2025-48172
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.