CVE-2025-4638

CRITICAL EPSS 34.5%
Published May 14, 20251y ago · Modified Jun 17, 20262w ago
9.2 CVSS 4.0
Critical
Find Similar
Published May 14, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-dependent attackers to cause undefined behavior by exploiting improper pointer arithmetic. Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITH_SYSTEM_ZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib.

CVSS Details

Base Score
9.2
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Amber
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
34.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety

Affected Products 1

VendorProductVersionRange
pointcloudspoint_cloud_library* <1.14.0

References 3

  • github.com https://github.com/PointCloudLibrary/pcl/blob/master/surface/CMakeLists.txt#L70
    Product
  • github.com https://github.com/PointCloudLibrary/pcl/commit/502bd2b013ce635f21632d523aa8cf2e04f7b7ac
    Patch
  • github.com https://github.com/PointCloudLibrary/pcl/pull/6245
    Issue TrackingPatch

Remediation

  • github.com https://github.com/PointCloudLibrary/pcl/commit/502bd2b013ce635f21632d523aa8cf2e04f7b7ac
    Patch
  • github.com https://github.com/PointCloudLibrary/pcl/pull/6245
    Issue TrackingPatch