CVE-2025-53367 DjVuLibre OOB-Write Vulnerability in MMRDecoder
An out-of-bounds write in DjVuLibre's MMRDecoder allows attackers to corrupt heap memory, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-53367?
CVE-2025-53367 is a high-severity memory corruption vulnerability in DjvuNet DjVuLibre, published on 3 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.
Which versions are affected by CVE-2025-53367?
Linux distribution packages (7)
djvulibre SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 | All versions | 3.5.27-150200.11.17.1 |
djvulibre SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 3.5.27-150200.11.17.1 |
djvulibre SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 3.5.27-150200.11.17.1 |
djvulibre SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 3.5.27-150200.11.17.1 |
djvulibre SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.5.25.3-5.25.1 |
djvulibre openSUSE:Leap 15.6 | All versions | 3.5.27-150200.11.17.1 |
djvulibre openSUSE:Tumbleweed | All versions | 3.5.29-1.1 |
How do I fix CVE-2025-53367?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-53367 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53367 exists.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2025-53367, DSA-5960-1, MGASA-2025-0209, OESA-2025-1756, SUSE-SU-2025:02695-1, SUSE-SU-2025:02703-1 and 3 more.