CVE-2025-71264

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of...

3.7 LowFix available

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.29%Up 0.3 points since Mar 16, 2026

What each source reports

CVE List Score used 3.7

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Record: CVE-2025-71264
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-125
Updated: 2026-11-02

EUVDEUVD-2025-208685 3.7

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Record: EUVD-2025-208685
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-r4p8-phpj-5pvw 3.7

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of...

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Record: GHSA-r4p8-phpj-5pvw
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-125
Updated: 2026-11-02

NVD 3.7

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Record: CVE-2025-71264
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-125
Updated: 2026-11-02

OSV 3.7

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Record: CVE-2025-71264
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-125
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-71264 5.3

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Record: DEBIAN-CVE-2025-71264
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2025-71264 3.7

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Record: UBUNTU-CVE-2025-71264
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVMGASA-2026-0228 No score

Updated mumble packages fix security vulnerability

Mumble is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Record: MGASA-2026-0228
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10388-1 No score

mumble-1.5.857-2.1 on GA media

These are all security issues fixed in the mumble-1.5.857-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10388-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20394-1 No score

Security update for mumble

This update for mumble fixes the following issues:

Changes in mumble:

CVE-2025-71264: (opus) incorrect size calculations allow for an out-of-bounds array access and can lead to a client crash (boo#1259721)
Update to version 1.5.857:
- fixes for undesired ACL behavior
- Client bug fixes: UI, memory leaks, audio mute/volume behavior

Record: openSUSE-SU-2026:20394-1
Updated: 2026-11-02

Affected products

mumble

Affected packages

Affected packages
Package	Affected	Fixed
`mumble` Debian:12	All versions, plus listed versions 1.3.4-41.5.517-11.5.517-21.5.517-2.11.5.517-3 Show 10 moreShow less 1.5.735-11.5.735-21.5.735-31.5.735-41.5.735-51.5.735-61.5.735-71.5.735-81.5.857-11.5.857-2	None known
`mumble` Debian:13	before 1.5.735-5+deb13u1, plus listed versions 1.5.735-5	1.5.735-5+deb13u1
`mumble` Debian:14	before 1.5.735-7, plus listed versions 1.5.735-51.5.735-6	1.5.735-7
`mumble` Mageia:9	before 1.4.287-3.1.mga9	1.4.287-3.1.mga9
`mumble` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.2.8-2ubuntu11.2.12-1ubuntu11.2.12-1ubuntu1+esm1	None known
`mumble` Ubuntu:18.04:LTS	All versions, plus listed versions 1.2.18-11.2.19-11.2.19-1build11.2.19-1ubuntu11.2.19-1ubuntu1.1	None known
`mumble` Ubuntu:20.04:LTS	All versions, plus listed versions 1.3.0+dfsg-11.3.0+dfsg-1build11.3.0+dfsg-1ubuntu0.1	None known
`mumble` Ubuntu:22.04:LTS	All versions, plus listed versions 1.3.4-11.3.4-1ubuntu1	None known
`mumble` Ubuntu:24.04:LTS	All versions, plus listed versions 1.3.4-41.5.517-1ubuntu11.5.517-1ubuntu2	None known
`mumble` Ubuntu:25.10	All versions, plus listed versions 1.5.735-31.5.735-41.5.735-51.5.735-6	None known
`mumble` Ubuntu:26.04:LTS	All versions, plus listed versions 1.5.735-61.5.735-6build11.5.735-71.5.735-8	None known
`mumble` openSUSE:Tumbleweed	before 1.5.857-2.1	1.5.857-2.1
`mumble` openSUSE:Leap 16.0	before 1.5.857-bp160.1.1	1.5.857-bp160.1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-71264 is a low vulnerability (CVSS 3.7) in Mumble, published March 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. Fixed in mumble 1.5.735-5+deb13u1.

References

Show 8 moreShow less