CVE-2025-0838 Heap Buffer overflow in Abseil
An integer overflow in Abseil hash containers allows attackers to trigger heap buffer overflows, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-0838?
CVE-2025-0838 is a medium-severity vulnerability in Debian Debian Linux, published on 21 Feb 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1
Weakness: CWE-190
Which versions are affected by CVE-2025-0838?
It affects 2 products.
Linux distribution packages (9)
abseil-cpp SUSE:Linux Enterprise Micro 5.3 | All versions | 20230802.3-150400.10.7.1 |
abseil-cpp SUSE:Linux Enterprise Micro 5.4 | All versions | 20240116.3-150500.13.10.1 |
abseil-cpp SUSE:Linux Enterprise Micro 5.5 | All versions | 20240116.3-150500.13.10.1 |
abseil-cpp SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 20240116.3-150600.19.6.1 |
abseil-cpp SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 20240116.3-8.6.1 |
abseil-cpp SUSE:Linux Micro 6.0 | All versions | 20230802.3-1.1 |
abseil-cpp SUSE:Linux Micro 6.1 | All versions | 20230802.3-slfo.1.1_1.1 |
abseil-cpp openSUSE:Leap 15.6 | All versions | 20240116.3-150600.19.6.1 |
abseil-cpp openSUSE:Tumbleweed | All versions | 20250814.0-2.1 |
Products include Abseil Common Libraries, Debian Debian Linux.
How do I fix CVE-2025-0838?
Upgrade to a fixed version.
Is CVE-2025-0838 being exploited?
There is no known exploitation of CVE-2025-0838 in the wild and no public exploit code.
Sources
Also known as AZL-76815, AZL-76853, AZL-76968, AZL-77043, BELL-CVE-2025-0838, DEBIAN-CVE-2025-0838 and 13 more.