CVE-2025-50343
CriticalSummary
An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in Mat_VarCreateStruct() when the nfields value does not match the actual number of strings in the fields array. This leads to out-of-bounds reads and invalid memory frees during cleanup, potentially causing a segmentation fault or heap corruption.
Risk Assessment
The risk for the organization is the possibility of application crashes or potential exploitation of the vulnerability to compromise memory integrity, potentially leading to unauthorized access or denial of service.
Recommendation
It is recommended to update the matio library to a version that includes the fix and to test applications for compatibility with the new version.
Original NVD description (English source)
An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in Mat_VarCreateStruct() when the nfields value does not match the actual number of strings in the fields array. This leads to out-of-bounds reads and invalid memory frees during cleanup, potentially causing a segmentation fault or heap corruption.