Every CVE Search/ Get API key

CVE-2025-53367

DjVuLibre OOB-Write Vulnerability in MMRDecoder

8.4 HighPublic exploitFix available

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.87%Up 0.9 points since Jul 4, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.4

DjVuLibre OOB-Write Vulnerability in MMRDecoder

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.

Record
CVE-2025-53367
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-787, CWE-125
Updated
2026-11-02
EUVDEUVD-2025-19908 8.4

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.

Record
EUVD-2025-19908
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 8.4

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.

Record
CVE-2025-53367
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-125, CWE-787
Updated
2026-11-02
OSV 8.4

DjVuLibre OOB-Write Vulnerability in MMRDecoder

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.

Record
CVE-2025-53367
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVDEBIAN-CVE-2025-53367 8.4

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.

Record
DEBIAN-CVE-2025-53367
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2025-1756 6.6

djvulibre security update

DjVu is a set of compression technologies, a file format, and a software platform for the deliveryover the Web of digital documents, scanned documents, and high resolution images.DjVu documents download and display extremely quickly, and look exactly the same on all platforms with no compatibility problems due to fonts, colors, etc. DjVu can be seen as a superior alternative to PDF and PostScript for digital documents, to TIFF (and PDF) for scanned bitonal documents, to JPEG and JPEG2000 for photographs and pictures, and to GIF for large palettized images. DjVu is the only Web format that is practical for distributing high-resolution scanned documents in color.

Security Fix(es):

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.(CVE-2025-53367)

Record
OESA-2025-1756
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2025-53367 8.4

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.

Record
UBUNTU-CVE-2025-53367
CVSS 4.0
8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVMGASA-2025-0209 No score

Updated djvulibre packages fix security vulnerability

An out-of-bounds write in the MMRDecoder::scanruns method was fixed. The vulnerability could be exploited to gain code execution on a Linux Desktop system when the user tries to open a crafted document.

Record
MGASA-2025-0209
Updated
2026-11-02
OSVopenSUSE-SU-2025:15319-1 No score

djvulibre-3.5.29-1.1 on GA media

These are all security issues fixed in the djvulibre-3.5.29-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15319-1
Updated
2026-11-02
OSVSUSE-SU-2025:02695-1 No score

Security update for djvulibre

This update for djvulibre fixes the following issues:

  • CVE-2025-53367: Fixed a bug where a crafted document may lead to an out of bound write. (bsc#1245773)
Record
SUSE-SU-2025:02695-1
Updated
2026-11-02
OSVSUSE-SU-2025:02703-1 No score

Security update for djvulibre

This update for djvulibre fixes the following issues:

  • CVE-2025-53367: Fixed a bug where a crafted document may lead to an out of bound write. (bsc#1245773)
Record
SUSE-SU-2025:02703-1
Updated
2026-11-02
OSVUSN-7631-1 No score

djvulibre vulnerability

It was discovered that DjVuLibre incorrectly handled certain memory operations. If a user or automated system were tricked into processing a specially crafted DjVu file, a remote attacker could cause applications to stop responding or crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-7631-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
djvulibre
Debian:12
 before 3.5.28-2.1~deb12u1, plus listed versions
3.5.28-2
3.5.28-2.1~deb12u1
djvulibre
Debian:13
 before 3.5.28-2.1
3.5.28-2.1
djvulibre
Debian:14
 before 3.5.28-2.1
3.5.28-2.1
djvulibre
Debian:11
From an advisory covering 3 CVEs
 before 3.5.28-2.2~deb11u1, plus listed versions
3.5.28-23.5.28-2.13.5.28-2.1~deb12u1
3.5.28-2.2~deb11u1
djvulibre
Mageia:9
 before 3.5.29-1.mga9
3.5.29-1.mga9
djvulibre
openEuler:22.03-LTS-SP4
 before 3.5.27-20.oe2203sp4
3.5.27-20.oe2203sp4
djvulibre
openEuler:24.03-LTS
 before 3.5.28-2.oe2403sp2
3.5.28-2.oe2403sp2
djvulibre
openEuler:24.03-LTS-SP1
 before 3.5.28-2.oe2403sp1
3.5.28-2.oe2403sp1
djvulibre
openEuler:24.03-LTS-SP2
 before 3.5.28-2.oe2403sp2
3.5.28-2.oe2403sp2
djvulibre
openEuler:20.03-LTS-SP4
 before 3.5.27-21.oe2003sp4
3.5.27-21.oe2003sp4
Show 13 moreShow less
Affected packages
PackageAffectedFixed
djvulibre
openEuler:22.03-LTS-SP3
 before 3.5.27-20.oe2203sp3
3.5.27-20.oe2203sp3
djvulibre
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 3.5.25.3-5.25.1
3.5.25.3-5.25.1
djvulibre
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
 before 3.5.27-150200.11.17.1
3.5.27-150200.11.17.1
djvulibre
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
 before 3.5.27-150200.11.17.1
3.5.27-150200.11.17.1
djvulibre
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 3.5.27-150200.11.17.1
3.5.27-150200.11.17.1
djvulibre
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 3.5.27-150200.11.17.1
3.5.27-150200.11.17.1
djvulibre
openSUSE:Leap 15.6
 before 3.5.27-150200.11.17.1
3.5.27-150200.11.17.1
djvulibre
Ubuntu:Pro:16.04:LTS
 before 3.5.27.1-5ubuntu0.1+esm3, plus listed versions
3.5.27.1-33.5.27.1-43.5.27.1-53.5.27.1-5ubuntu0.13.5.27.1-5ubuntu0.1+esm13.5.27.1-5ubuntu0.1+esm2
3.5.27.1-5ubuntu0.1+esm3
djvulibre
Ubuntu:Pro:18.04:LTS
 before 3.5.27.1-8ubuntu0.4+esm1, plus listed versions
3.5.27.1-73.5.27.1-83.5.27.1-8ubuntu0.13.5.27.1-8ubuntu0.23.5.27.1-8ubuntu0.33.5.27.1-8ubuntu0.4
3.5.27.1-8ubuntu0.4+esm1
djvulibre
Ubuntu:Pro:20.04:LTS
 before 3.5.27.1-14ubuntu0.1+esm1, plus listed versions
3.5.27.1-133.5.27.1-13ubuntu13.5.27.1-143.5.27.1-14build13.5.27.1-14ubuntu0.1
3.5.27.1-14ubuntu0.1+esm1
djvulibre
Ubuntu:22.04:LTS
 before 3.5.28-2ubuntu0.22.04.1, plus listed versions
3.5.28-2build13.5.28-2build2
3.5.28-2ubuntu0.22.04.1
djvulibre
Ubuntu:24.04:LTS
 before 3.5.28-2ubuntu0.24.04.1, plus listed versions
3.5.28-2build33.5.28-2build4
3.5.28-2ubuntu0.24.04.1
djvulibre
openSUSE:Tumbleweed
 before 3.5.29-1.1
3.5.29-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubkevinbackhouse/DjVuLibre-poc-CVE-2025-533672025-07-18
PoC in GitHubThePhykon/CVE-2025-53367-POC2025-11-17

History

History
RecordedChangedSources
affected, exploits, facts
first indexedCVE List, EUVD, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-53367 is a high vulnerability (CVSS 8.4) in Djvunet Djvulibre, published July 3, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. Fixed in djvulibre 3.5.28-2.1~deb12u1.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open