Every CVE Search/ Get API key

CVE-2025-50343

An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in...

9.8 CriticalFix availableRejected

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

What each source reports

GitHub Advisories Score usedGHSA-54r5-8767-w6vq 9.8

An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in...

An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in Mat_VarCreateStruct() when the nfields value does not match the actual number of strings in the fields array. This leads to out-of-bounds reads and invalid memory frees during cleanup, potentially causing a segmentation fault or heap corruption.

Record
GHSA-54r5-8767-w6vq
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
CVE List No score

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
CVE-2025-50343
Updated
2026-11-02
EUVDEUVD-2025-205846 9.8

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
EUVD-2025-205846
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD No score

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
CVE-2025-50343
Updated
2026-11-02
OSV 9.8

An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in Mat_VarCreateStruct() when the nfields value does not match the actual number of strings in the fields array. This leads to out-of-bounds reads and invalid memory frees during cleanup, potentially causing a segmentation fault or heap corruption. NOTE: Multiple third-parties note that the available evidence does not demonstrate a vulnerability exploitable through an attacker-controlled input path.

Record
CVE-2025-50343
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2025-50343 9.8

An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in Mat_VarCreateStruct() when the nfields value does not match the actual number of strings in the fields array. This leads to out-of-bounds reads and invalid memory frees during cleanup, potentially causing a segmentation fault or heap corruption. NOTE: Multiple third-parties note that the available evidence does not demonstrate a vulnerability exploitable through an attacker-controlled input path.

Record
DEBIAN-CVE-2025-50343
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-50343 9.8

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
UBUNTU-CVE-2025-50343
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:10094-1 No score

libmatio-devel-1.5.30-1.1 on GA media

These are all security issues fixed in the libmatio-devel-1.5.30-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10094-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
libmatio
Debian:12
 before 1.5.23-2+deb12u1, plus listed versions
1.5.23-2
1.5.23-2+deb12u1
libmatio
Debian:13
 All versions, plus listed versions
1.5.28-21.5.29-11.5.30-11.5.30-21.5.30-31.5.30-41.6.0-1
 None known
libmatio
Debian:14
 before 1.5.30-2, plus listed versions
1.5.28-21.5.29-11.5.30-1
1.5.30-2
libmatio
Debian:11
From an advisory covering 3 CVEs
 before 1.5.19-2+deb11u1, plus listed versions
1.5.19-2
1.5.19-2+deb11u1
libmatio
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.5.1-11.5.2-11.5.2-1ubuntu11.5.2-1ubuntu1+esm1
 None known
libmatio
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.2-3build21.5.3-11.5.3-1ubuntu0.1~esm1
 None known
libmatio
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.5.10-11.5.11-11.5.11-1ubuntu0.1~esm1
 None known
libmatio
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.5.13-31.5.17-31.5.17-3ubuntu0.1~esm11.5.17-3ubuntu0.1~esm2
 None known
libmatio
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.5.19-21.5.21-11.5.21-1ubuntu0.1~esm1
 None known
libmatio
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.5.23-21.5.24-11.5.26-11.5.26-1build11.5.26-1build21.5.26-1build3
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
libmatio
Ubuntu:25.10
 All versions, plus listed versions
1.5.28-1build11.5.28-2
 None known
libmatio
Ubuntu:26.10
 All versions, plus listed versions
1.5.30-21.5.30-41.5.30-4build1
 None known
libmatio
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.5.28-21.5.29-11.5.30-2
 None known
matio
openSUSE:Tumbleweed
 before 1.5.30-1.1
1.5.30-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-50343 has been rejected by its source and should not be treated as a live vulnerability, published December 30, 2025. Fixed in libmatio 1.5.23-2+deb12u1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open