CVE-2025-58477
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
An out-of-bounds write exists in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1. A remote attacker can access out-of-bounds memory.
Risk Assessment
This could lead to memory corruption, application crashes, or potentially arbitrary code execution. The risk is high when processing untrusted images with malicious IFD tags.
Recommendation
Apply SMR Dec-2025 Release 1 or later. Avoid processing untrusted image files until the update is applied.
Other vulnerabilities in libimagecodec.quram.so
See all- CVE-2026-21096Critical
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-21095Critical
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2025-21043HighActively exploited
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. The vulnerability affects image processing within this library.
- CVE-2025-21042HighActively exploited
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. The vulnerability affects image processing within this library.
- CVE-2025-58479Medium
An out-of-bounds read exists in libimagecodec.quram.so prior to SMR Dec-2025 Release 1. A remote attacker can access out-of-bounds memory.
- CVE-2025-58478Medium
An out-of-bounds write exists in libimagecodec.quram.so prior to SMR Dec-2025 Release 1. A remote attacker can access out-of-bounds memory.
- CVE-2025-21055Medium
Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to access out-of-bounds memory.
Original NVD description (English source)
Out-of-bounds write in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS