CVE-2025-47256

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c...

5.6 MediumPublic exploitFix available

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.30%Up 0.3 points since May 7, 2025

What each source reports

CVE List Score used 5.6

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Record: CVE-2025-47256
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness: CWE-191
Updated: 2026-11-02

EUVDEUVD-2025-13638 5.6

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Record: EUVD-2025-13638
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vg32-cm75-rjr5 5.6

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c...

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Record: GHSA-vg32-cm75-rjr5
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness: CWE-191
Updated: 2026-11-02

NVD 5.6

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Record: CVE-2025-47256
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness: CWE-191
Updated: 2026-11-02

OSV 5.6

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Record: CVE-2025-47256
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness: CWE-191
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-47256 5.6

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Record: DEBIAN-CVE-2025-47256
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-47256 5.6

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Record: UBUNTU-CVE-2025-47256
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated: 2026-11-02

OSVMGASA-2026-0191 No score

Updated libxmp packages fix security vulnerabilities

CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit() CVE-2023-45680: Null pointer dereference in vorbis_deinit() CVE-2023-45681: Out of bounds heap buffer write CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder() CVE-2023-45677: Heap buffer out of bounds write in start_decoder() CVE-2023-45682: Wild address read in vorbis_decode_packet_rest() CVE-2025-47256 stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Record: MGASA-2026-0191
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15081-1 No score

libxmp-devel-4.6.3-1.1 on GA media

These are all security issues fixed in the libxmp-devel-4.6.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15081-1
Updated: 2026-11-02

Affected products

libxmp

Affected packages

Affected packages
Package	Affected	Fixed
`libxmp` Debian:12	All versions, plus listed versions 4.5.0-24.6.0-14.6.0-24.6.0-34.6.0-3~bpo12+1 Show 9 moreShow less 4.6.1-14.6.1-24.6.2-14.6.2-24.6.3-14.6.3-24.7.0-14.7.1-14.7.2-1	None known
`libxmp` Debian:13	before 4.6.2-2	4.6.2-2
`libxmp` Debian:14	before 4.6.2-2	4.6.2-2
`libxmp` Mageia:9 From an advisory covering 7 CVEs	before 4.5.0-2.1.mga9	4.5.0-2.1.mga9
`libxmp` Ubuntu:16.04:LTS	All versions, plus listed versions 4.3.9-14.3.10-14.3.11-1	None known
`libxmp` Ubuntu:18.04:LTS	All versions, plus listed versions 4.4.1-1	None known
`libxmp` Ubuntu:20.04:LTS	All versions, plus listed versions 4.4.1-2	None known
`libxmp` Ubuntu:22.04:LTS	All versions, plus listed versions 4.4.1-34.5.0-1	None known
`libxmp` Ubuntu:24.04:LTS	All versions, plus listed versions 4.6.0-2	None known
`libxmp` Ubuntu:25.10	All versions, plus listed versions 4.6.2-14.6.2-2	None known
`libxmp` openSUSE:Tumbleweed	before 4.6.3-1.1	4.6.3-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	SexyShoelessGodofWar/CVE-2025-47256	2025-05-05

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-47256 is a medium vulnerability (CVSS 5.6) in Libxmp, published May 6, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in libxmp 4.6.2-2.

References

Show 10 moreShow less