CVE-2025-0633 Heap Overflow in iniparser.c
A heap-based buffer overflow in the iniparser library allows attackers to read out-of-bounds memory, potentially leading to information disclosure or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-0633?
CVE-2025-0633 is a medium-severity memory corruption vulnerability in iniparser, published on 19 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacker to read out of bound memory
Weakness: CWE-122
Which versions are affected by CVE-2025-0633?
Linux distribution packages (4)
iniparser SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 4.1-150500.4.8.1 |
iniparser SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.1.0.git20140619_c5beb80a-3.6.1 |
iniparser openSUSE:Leap 15.6 | All versions | 4.1-150500.4.8.1 |
iniparser openSUSE:Tumbleweed | All versions | 4.2.6-1.1 |
How do I fix CVE-2025-0633?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-0633 being exploited?
There is no known exploitation of CVE-2025-0633 in the wild and no public exploit code.
Sources
Also known as AZL-56943, AZL-57019, DEBIAN-CVE-2025-0633, ECHO-5d31-188a-5e5c, GHSA-2599-v2c2-3fp3, MGASA-2025-0077 and 6 more.