CVE-2025-62813

lz4: LZ4 null handling error

Published Oct 23, 2025 CVSS 3.1 · 5.9 Medium EPSS n/a KEV · Not listed

Description

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Affected Products

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82
https://github.com/lz4/lz4/pull/1593
https://nvd.nist.gov/vuln/detail/CVE-2025-62813
https://www.cve.org/CVERecord?id=CVE-2025-62813

History

Oct 30, 2025 9:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 29, 2025 5:45 AM Description updated View changes

Type	Values Removed	Values Added
Description	LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.	DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Oct 24, 2025 12:15 AM Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		lz4: LZ4 null handling error
References		https://nvd.nist.gov/vuln/detail/CVE-2025-62813 https://www.cve.org/CVERecord?id=CVE-2025-62813
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 23, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 23, 2025 10:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Lz4 Project Lz4 Project lz4
Vendors & Products		Lz4 Project Lz4 Project lz4

Oct 23, 2025 3:30 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.
Weaknesses		CWE-158
References		https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82 https://github.com/lz4/lz4/pull/1593
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H'}`