01 Record

CVE-2025-40082

hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()

HighPUBLISHEDCNA: Linux

CNA base score7.1 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

View raw JSON

02 Description

hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.18% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 7.7% of scored records. A rank, not a probability.
NVD base score: 7.1 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-07-30.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-10-28 11:48Z10 MO AGO

Last updated

2026-08-05 12:07Z1 MO AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.1)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weaknesses

CWE-125Out-of-bounds ReadBase

Data version

5.2

Document digest

9d6cc2da602e43e042471a72cc918c130bcb6ec8d3084062b865bf26343364c4

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxccf0ad56a779e6704c0b27f555dec847f50c7557 to < 343fe375a8dd6ee51a193a1c233b999f5ea4d479, 13604b1d7e7b125fb428cddbec6b8d92baad25d5 to < 782acde47e127c98a113726e2ff8024bd65c0454, 291bb5d931c6f3cd7227b913302a17be21cf53b0 to < c3db89ea1ed3d540eebe8f3c36e806fb75ee4a1e, f7534cbfac0a9ffa4fa17cacc6e8b6446dae24ee to < 5b5228964619b180f366940505b77255b1a03929, 94458781aee6045bd3d0ad4b80b02886b9e2219b to < 857aefc70d4ae3b9bf1ae67434d27d0f79f80c9e, 94458781aee6045bd3d0ad4b80b02886b9e2219b to < bea3e1d4467bcf292c8e54f080353d556d355e26, 73f7da507d787b489761a0fa280716f84fa32b2f, 76a4c6636a69d69409aa253b049b1be717a539c5, 6f93694bcbc2c2ab3e01cd8fba2f296faf34e6b9, 1ca69007e52a73bd8b84b988b61b319816ca8b01, 5.15.190 to < 5.15.200, 6.1.149 to < 6.1.163, 6.6.103 to < 6.6.124, 6.12.43 to < 6.12.70, 5.4.297 to < 5.5, 5.10.241 to < 5.11, 6.15.11 to < 6.16, 6.16.2 to < 6.17, 6.17—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/343fe375a8dd6ee51a193a1c233b999f5ea4d479
git.kernel.orghttps://git.kernel.org/stable/c/782acde47e127c98a113726e2ff8024bd65c0454
git.kernel.orghttps://git.kernel.org/stable/c/c3db89ea1ed3d540eebe8f3c36e806fb75ee4a1e
git.kernel.orghttps://git.kernel.org/stable/c/5b5228964619b180f366940505b77255b1a03929
git.kernel.orghttps://git.kernel.org/stable/c/857aefc70d4ae3b9bf1ae67434d27d0f79f80c9e
git.kernel.orghttps://git.kernel.org/stable/c/bea3e1d4467bcf292c8e54f080353d556d355e26

01 Record index

CVE-2025-40082

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2025-40082

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References