CVE-2025-58479
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
An out-of-bounds read exists in libimagecodec.quram.so prior to SMR Dec-2025 Release 1. A remote attacker can access out-of-bounds memory.
Risk Assessment
This could lead to data leakage or application crashes when processing images. The vulnerability is especially dangerous when handling untrusted image files.
Recommendation
Apply SMR Dec-2025 Release 1 or later. Avoid opening untrusted images until the update is applied.
Other vulnerabilities in libimagecodec.quram.so
See all- CVE-2026-21096Critical
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-21095Critical
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2025-21043HighActively exploited
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. The vulnerability affects image processing within this library.
- CVE-2025-21042HighActively exploited
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. The vulnerability affects image processing within this library.
- CVE-2025-58478Medium
An out-of-bounds write exists in libimagecodec.quram.so prior to SMR Dec-2025 Release 1. A remote attacker can access out-of-bounds memory.
- CVE-2025-58477Medium
An out-of-bounds write exists in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1. A remote attacker can access out-of-bounds memory.
- CVE-2025-21055Medium
Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to access out-of-bounds memory.
Original NVD description (English source)
Out-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS