CVE-2025-46171
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability in vBulletin 3.8.7 allows a DoS attack via the misc.php?do=buddylist endpoint. An authenticated user with an excessively large buddy list can cause excessive memory consumption, exhausting system resources and crashing the forum.
Risk Assessment
The risk is that an authenticated user can intentionally overload the server, leading to forum unavailability for all users and potential data loss in case of an unexpected shutdown.
Recommendation
It is recommended to limit the maximum buddy list size in vBulletin configuration or apply a security patch from the vendor if available. Also monitor memory usage of the forum process.
Original NVD description (English source)
vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum.