CVE-2025-48172

CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c...

5.6 MediumFix available

CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.18%Up 0.2 points since Jul 5, 2025

What each source reports

CVE List Score used 5.6

CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.

Record: CVE-2025-48172
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness: CWE-190
Updated: 2026-11-02

EUVDEUVD-2025-20018 5.6

CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.

Record: EUVD-2025-20018
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rpc6-w47v-qqr6 5.6

CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c...

CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.

Record: GHSA-rpc6-w47v-qqr6
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness: CWE-190
Updated: 2026-11-02

NVD 5.6

CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.

Record: CVE-2025-48172
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness: CWE-190
Updated: 2026-11-02

OSV 5.6

CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.

Record: CVE-2025-48172
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness: CWE-190
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-48172 5.6

CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.

Record: UBUNTU-CVE-2025-48172
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15326-1 No score

chmlib-devel-0.40-26.1 on GA media

These are all security issues fixed in the chmlib-devel-0.40-26.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15326-1
Updated: 2026-11-02

Affected products

chmlib

Affected packages

Affected packages
Package	Affected	Fixed
`chmlib` Ubuntu:16.04:LTS	All versions, plus listed versions 2:0.40a-3	None known
`chmlib` Ubuntu:18.04:LTS	All versions, plus listed versions 2:0.40a-32:0.40a-4	None known
`chmlib` Ubuntu:20.04:LTS	All versions, plus listed versions 2:0.40a-5	None known
`chmlib` Ubuntu:22.04:LTS	All versions, plus listed versions 2:0.40a-7	None known
`chmlib` Ubuntu:24.04:LTS	All versions, plus listed versions 2:0.40a-8	None known
`chmlib` Ubuntu:25.10	All versions, plus listed versions 2:0.40a-8.1	None known
`chmlib` Ubuntu:26.10	All versions, plus listed versions 2:0.40a-9	None known
`chmlib` Ubuntu:26.04:LTS	All versions, plus listed versions 2:0.40a-8.12:0.40a-9	None known
`chmlib` openSUSE:Tumbleweed	before 0.40-26.1	0.40-26.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-48172 is a medium vulnerability (CVSS 5.6) in Chmlib, published July 4, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in chmlib 0.40-26.1.

References

Show 4 moreShow less