Every CVE Search/ Get API key

CVE-2025-62813

LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly...

5.9 MediumFix availableRejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

What each source reports

GitHub Advisories Score usedGHSA-r7j2-9m2h-fq95 5.9

LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly...

LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.

Record
GHSA-r7j2-9m2h-fq95
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-158
Updated
2026-11-02
CVE List No score

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
CVE-2025-62813
Updated
2026-11-02
EUVDEUVD-2025-35652 No score

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
EUVD-2025-35652
Updated
2026-11-02
NVD No score

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
CVE-2025-62813
Updated
2026-11-02
OSVBELL-CVE-2025-62813 5.9

CVE-2025-62813 does not affect BellSoft software

Record
BELL-CVE-2025-62813
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSV 5.9

LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.

Record
CVE-2025-62813
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2025-62813 5.9

LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.

Record
UBUNTU-CVE-2025-62813
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2025-62813 No score

LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.

Record
DEBIAN-CVE-2025-62813
Updated
2026-11-02
OSVMGASA-2026-0145 No score

Updated firefox & thunderbird packages fix security vulnerabilities

LZ4 compression library issue. (CVE-2025-62813) libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. (CVE-2026-32776) libexpat before 2.7.5 allows an infinite loop while parsing DTD content. (CVE-2026-32777) libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. (CVE-2026-32778) Use-after-free in the DOM: Networking component. (CVE-2026-8090) Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2, Firefox 150.0.2, Thunderbird ESR 140.10.2 and Thunderbird 150.0.2. (CVE-2026-8092) Another issue in the WebRTC component. (CVE-2026-8094)

Record
MGASA-2026-0145
Updated
2026-11-02
OSVopenSUSE-SU-2025:15675-1 No score

coreboot-utils-25.09-2.1 on GA media

These are all security issues fixed in the coreboot-utils-25.09-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15675-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15678-1 No score

libmozjs-115-0-115.15.0-6.1 on GA media

These are all security issues fixed in the libmozjs-115-0-115.15.0-6.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15678-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15679-1 No score

libmozjs-128-0-128.14.0-2.1 on GA media

These are all security issues fixed in the libmozjs-128-0-128.14.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15679-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15688-1 No score

libmozjs-140-0-140.4.0-2.1 on GA media

These are all security issues fixed in the libmozjs-140-0-140.4.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15688-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
firefox
Mageia:9
From an advisory covering 7 CVEs
 before 140.10.2-1.mga9
140.10.2-1.mga9
firefox-l10n
Mageia:9
From an advisory covering 7 CVEs
 before 140.10.2-1.mga9
140.10.2-1.mga9
thunderbird
Mageia:9
From an advisory covering 7 CVEs
 before 140.10.2-1.mga9
140.10.2-1.mga9
thunderbird-l10n
Mageia:9
From an advisory covering 7 CVEs
 before 140.10.2-1.mga9
140.10.2-1.mga9
coreboot-utils
openSUSE:Tumbleweed
 before 25.09-2.1
25.09-2.1
mozjs115
openSUSE:Tumbleweed
 before 115.15.0-6.1
115.15.0-6.1
mozjs128
openSUSE:Tumbleweed
 before 128.14.0-2.1
128.14.0-2.1
mozjs140
openSUSE:Tumbleweed
 before 140.4.0-2.1
140.4.0-2.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-62813 has been rejected by its source and should not be treated as a live vulnerability, published October 23, 2025. Fixed in coreboot-utils 25.09-2.1.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open