CVE-2025-71264

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2025-71264", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-03-16T06:13:50.762Z", "datePublished": "2026-03-16T06:13:51.207Z", "dateUpdated": "2026-03-16T14:40:37.627Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mumble", "vendor": "Mumble", "versions": [{"lessThan": "1.6.870", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash)."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-16T06:21:34.829Z"}, "references": [{"url": "https://github.com/mumble-voip/mumble/commit/ff2a2332cccb267721553f09c0ded4de880622e0"}, {"url": "https://github.com/mumble-voip/mumble/pull/7032"}, {"url": "https://bugs.debian.org/1129178"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-71264", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T13:44:30.386354Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T14:40:37.627Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-71264", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T13:44:30.386354Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T14:37:12.666Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mumble", "product": "Mumble", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.870", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/mumble-voip/mumble/commit/ff2a2332cccb267721553f09c0ded4de880622e0"}, {"url": "https://github.com/mumble-voip/mumble/pull/7032"}, {"url": "https://bugs.debian.org/1129178"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-16T06:21:34.829Z"}}}, "cveMetadata": {"cveId": "CVE-2025-71264", "state": "PUBLISHED", "dateUpdated": "2026-03-16T14:40:37.627Z", "dateReserved": "2026-03-16T06:13:50.762Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-16T06:13:51.207Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mumble", "vendor": "Mumble", "versions": [{"lessThan": "1.6.870", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mumble:mumble:*:*:*:*:*:*:*:*", "matchCriteriaId": "52B1AACF-1BF7-46CA-8420-BF7780B1FBD4", "versionEndExcluding": "1.6.870", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash)."}, {"lang": "es", "value": "Mumble anterior a 1.6.870 es propenso a un acceso a un array fuera de l\u00edmites, lo que puede resultar en una denegaci\u00f3n de servicio (ca\u00edda del cliente)."}], "id": "CVE-2025-71264", "lastModified": "2026-06-17T10:03:58.433", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71264", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T13:44:30.386354Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:18:02.610", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List"], "url": "https://bugs.debian.org/1129178"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/mumble-voip/mumble/commit/ff2a2332cccb267721553f09c0ded4de880622e0"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/mumble-voip/mumble/pull/7032"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.6.870)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Mumble", "source": "cna", "vendor": "Mumble"}, "product": "mumble", "vendor": "mumble"}], "analysis": {"en": {"generated_at": "2026-04-02T17:00:34.624933+00:00", "value": {"mitigation_remediation": ["Upgrade to Mumble 1.6.870 or later."], "summary": {"action": "Patch", "impact": "Denial of Service (client crash)"}, "threat_synthesis": {"affected_systems": "The affected product is the Mumble audio\u2011chat client from the Mumble project. All releases before 1.6.870 contain the bug. Users on Windows, macOS, Linux, or other supported platforms running any pre\u20111.6.870 build are at risk. The vulnerability is vendor and product specific and is mitigated by acquiring a later version.", "description_and_impact": "The vulnerability is an out\u2011of\u2011bounds array access that may cause the client to terminate. The crash results in denial of service, disrupting the end\u2011user's ability to communicate. This weakness is classified as CWE\u2011125 and does not provide code execution or privileged escalation. The impact is confined to the local machine where the Mumble client runs.", "risk_and_exploitability": "The CVSS score of 3.7 indicates moderate severity, and the EPSS of less than 1\u202f% shows a low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog, suggesting no known widespread exploitation. Attacking this flaw would require that a malicious packet be processed by the client, likely from a remote server or a local user providing malformed data; these inferences are based on the nature of an out\u2011of\u2011bounds access and are not directly stated in the CVE description."}}}}, "created": "2026-03-17T09:53:18.630869+00:00", "updated": "2026-04-02T20:23:37.850554+00:00", "vendors": ["mumble", "mumble$PRODUCT$mumble"]}