{"id":"CVE-2025-71264","aliases":["DEBIAN-CVE-2025-71264","EUVD-2025-208685","GHSA-r4p8-phpj-5pvw","MGASA-2026-0228","UBUNTU-CVE-2025-71264","openSUSE-SU-2026:10388-1","openSUSE-SU-2026:20394-1"],"status":"published","title":"Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of...","description":"Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00293,"percentile":0.22115,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-03-16T06:13:51Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"Debian:13","package":"mumble","fixed_in":["1.5.735-5+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mumble","fixed_in":["1.5.735-7"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"mumble","fixed_in":["1.4.287-3.1.mga9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mumble","fixed_in":["1.5.857-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"mumble","fixed_in":["1.5.857-bp160.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4-4","1.5.517-1","1.5.517-2","1.5.517-2.1","1.5.517-3","1.5.735-1","1.5.735-2","1.5.735-3","1.5.735-4","1.5.735-5","1.5.735-6","1.5.735-7","1.5.735-8","1.5.857-1","1.5.857-2"]},{"source":"osv","ecosystem":"Debian:13","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.735-5+deb13u1"}]}],"versions":["1.5.735-5"]},{"source":"osv","ecosystem":"Debian:14","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.735-7"}]}],"versions":["1.5.735-5","1.5.735-6"]},{"source":"osv","ecosystem":"Mageia:9","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.287-3.1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.8-2ubuntu1","1.2.12-1ubuntu1","1.2.12-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.18-1","1.2.19-1","1.2.19-1build1","1.2.19-1ubuntu1","1.2.19-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0+dfsg-1","1.3.0+dfsg-1build1","1.3.0+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4-1","1.3.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4-4","1.5.517-1ubuntu1","1.5.517-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.735-3","1.5.735-4","1.5.735-5","1.5.735-6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.735-6","1.5.735-6build1","1.5.735-7","1.5.735-8"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.857-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.857-bp160.1.1"}]}]}],"products":[{"vendor":"mumble","product":"mumble"}],"references":[{"url":"https://github.com/mumble-voip/mumble/commit/ff2a2332cccb267721553f09c0ded4de880622e0","tags":["Patch","fix"]},{"url":"https://github.com/mumble-voip/mumble/pull/7032","tags":["Issue Tracking","Patch","fix","report"]},{"url":"https://bugs.debian.org/1129178","tags":["Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71264","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r4p8-phpj-5pvw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71264.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-71264","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0228.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35255","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3QN37YWSAQPRISZSMYZGGSBEU36CO5SW/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-71264","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-71264","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71264","tags":["web"]},{"url":"https://bugzilla.suse.com/1259721","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-71264","description":"Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).","status":"published","published":"2026-03-16T06:13:51.207Z","modified":"2026-03-16T14:40:37.627Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-208685","description":"Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).","status":"published","published":"2026-03-16T06:13:51Z","modified":"2026-03-16T14:40:37Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T19:25:34.563327Z"}],"ghsa":[{"id":"GHSA-r4p8-phpj-5pvw","title":"Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of...","description":"Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).","status":"published","published":"2026-03-16T15:30:42Z","modified":"2026-03-16T15:30:56Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:06:38.778049Z"}],"nvd":[{"id":"CVE-2025-71264","description":"Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).","status":"published","published":"2026-03-16T14:18:02.61Z","modified":"2026-06-17T10:03:58.433Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:01.641503Z"}],"osv":[{"id":"CVE-2025-71264","description":"Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).","status":"published","published":"2026-03-16T06:13:51.207Z","modified":"2026-10-28T02:30:57.77690233Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"DEBIAN-CVE-2025-71264","description":"Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).","status":"published","published":"2026-03-16T14:18:02.61Z","modified":"2026-09-01T20:05:58.608428599Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"UBUNTU-CVE-2025-71264","description":"Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).","status":"published","published":"2026-03-16T14:18:00Z","modified":"2026-05-20T16:23:57.540385155Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"MGASA-2026-0228","title":"Updated mumble packages fix security vulnerability","description":"Mumble is prone to an out-of-bounds array access, which may result in\ndenial of service (client crash).\n","status":"published","published":"2026-06-23T06:04:47Z","modified":"2026-06-23T06:15:04.813208768Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10388-1","title":"mumble-1.5.857-2.1 on GA media","description":"These are all security issues fixed in the mumble-1.5.857-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-18T00:00:00Z","modified":"2026-03-19T08:45:07.159528Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20394-1","title":"Security update for mumble","description":"This update for mumble fixes the following issues:\n\nChanges in mumble:\n\n- CVE-2025-71264: (opus) incorrect size calculations allow for an\n  out-of-bounds array access and can lead to a client crash (boo#1259721)\n\n- Update to version 1.5.857:\n  * fixes for undesired ACL behavior\n  * Client bug fixes: UI, memory leaks, audio mute/volume behavior\n","status":"published","published":"2026-03-18T20:03:58Z","modified":"2026-03-26T17:23:50.053122Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}