CVE-2025-2900 IBM Semeru Runtime denial of service
A buffer overflow in the native AES/CBC encryption implementation allows attackers to cause a denial of service via application crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-2900?
CVE-2025-2900 is a high-severity memory corruption vulnerability in IBM Semeru Runtime, published on 14 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Semeru Runtime 8.0.302.0 through 8.0.442.0, 11.0.12.0 through 11.0.26.0, 17.0.0.0 through 17.0.14.0, and 21.0.0.0 through 12.0.6.0 is vulnerable to a denial of service caused by a buffer overflow and subsequent crash, due to a defect in its native AES/CBC encryption implementation.
Which versions are affected by CVE-2025-2900?
It affects 1 product.
Products include Ibm Semeru Runtime.
How do I fix CVE-2025-2900?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-2900 being exploited?
There is no known exploitation of CVE-2025-2900 in the wild and no public exploit code.
Other vulnerabilities in IBM Semeru Runtime
Sources
Also known as GHSA-6pp6-5h3q-mgg3.