CVE-2025-46333 z2d OOB composition could lead to invalid memory access and corruption
An integer overflow in z2d's stride calculation during anti-aliased rendering can cause memory corruption and potential code execution in optimized builds.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-46333?
CVE-2025-46333 is a high-severity vulnerability in vancluever z2d, published on 25 Apr 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
z2d is a pure Zig 2D graphics library. Versions of z2d after `0.5.1` and up to and including `0.6.0`, when writing from one surface to another using `z2d.compositor.StrideCompositor.run`, and higher-level operations when the anti-aliasing mode is set to `.default` (such as `Context.fill`, `Context.stroke`, `painter.fill`, and `painter.stroke`), the source surface can be completely out-of-bounds on the x-axis, but not on the y-axis, by way of a negative offset. This results in an overflow of the value controlling the length of the stride. In non-safe optimization modes (consumers compiling with `ReleaseFast` or `ReleaseSmall`), this could potentially lead to invalid memory accesses or corruption.
This issue is patched in version `0.6.1`. Users on an untagged version after `v0.5.1` and before `v0.6.1` are advised to update to address the vulnerability. Those still on Zig `0.13.0` are recommended to downgrade to `v0.5.1`.
Which versions are affected by CVE-2025-46333?
How do I fix CVE-2025-46333?
No fix has been published for CVE-2025-46333 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-46333 being exploited?
There is no known exploitation of CVE-2025-46333 in the wild and no public exploit code.
Sources
Also known as GHSA-mm4c-p35v-7hx3.