CVE-2025-4638 Improper Pointer Arithmetic in pcl
Improper pointer arithmetic in bundled zlib may cause undefined behavior, requiring system zlib usage or upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-4638?
CVE-2025-4638 is a critical memory corruption vulnerability in PointCloudLibrary pcl, published on 14 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-dependent attackers to cause undefined behavior by exploiting improper pointer arithmetic.
Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITH_SYSTEM_ZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib.
Weakness: CWE-119
Which versions are affected by CVE-2025-4638?
It affects 1 product.
Products include Pointclouds Point Cloud Library.
How do I fix CVE-2025-4638?
Change a configuration setting.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-4638 being exploited?
There is no known exploitation of CVE-2025-4638 in the wild and no public exploit code.
Sources
Also known as GHSA-hg9g-m8wg-jv2x, MGASA-2025-0162, UBUNTU-CVE-2025-4638.