{"id":"CVE-2025-50360","aliases":["EUVD-2025-201096","GHSA-vrr7-v9j5-cmr4"],"status":"published","title":"A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit...","description":"A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7. Malicious execution of a pepper source file(.pr) could lead to arbitrary code execution or Denial of Service.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00257,"percentile":0.17468,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-122"],"published":"2025-12-03T00:00:00Z","modified":"2026-11-04T22:10:00Z","exploits":[{"source":"pocgithub","id":"Ch1keen/CVE-2025-50360","title":"Ch1keen/CVE-2025-50360","date":"2025-07-21","url":"https://github.com/Ch1keen/CVE-2025-50360"}],"products":[{"vendor":"dannyvankooten","product":"pepper"}],"references":[{"url":"https://github.com/dannyvankooten/pepper-lang","tags":["Product","package"]},{"url":"https://github.com/Ch1keen/CVE-2025-50360","tags":["Exploit","Third Party Advisory","package"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50360","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vrr7-v9j5-cmr4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50360.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-50360","description":"A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7. Malicious execution of a pepper source file(.pr) could lead to arbitrary code execution or Denial of Service.","status":"published","published":"2025-12-03T00:00:00Z","modified":"2025-12-03T19:54:53.214Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:32:52.526476Z"}],"euvd":[{"id":"EUVD-2025-201096","description":"A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7. Malicious execution of a pepper source file(.pr) could lead to arbitrary code execution or Denial of Service.","status":"published","published":"2025-12-03T00:00:00Z","modified":"2025-12-03T19:54:53Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:10.321316Z"}],"ghsa":[{"id":"GHSA-vrr7-v9j5-cmr4","title":"A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit...","description":"A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7. Malicious execution of a pepper source file(.pr) could lead to arbitrary code execution or Denial of Service.","status":"published","published":"2025-12-03T21:31:04Z","modified":"2025-12-03T21:31:11Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:05:01.902395Z"}],"nvd":[{"id":"CVE-2025-50360","description":"A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7. Malicious execution of a pepper source file(.pr) could lead to arbitrary code execution or Denial of Service.","status":"published","published":"2025-12-03T19:15:56.42Z","modified":"2026-11-04T22:10:00.21Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-04T23:43:37.864413Z"}],"osv":[{"id":"CVE-2025-50360","description":"A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7. Malicious execution of a pepper source file(.pr) could lead to arbitrary code execution or Denial of Service.","status":"published","published":"2025-12-03T00:00:00Z","modified":"2026-11-05T21:16:07.710059681Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T22:00:58.054534Z"}]}}