CVE-2025-46333: z2d OOB composition could lead to invalid memory access and corruption
Description
z2d is a pure Zig 2D graphics library. In version 0.6.0, when writing from one surface to another using `z2d.compositor.StrideCompositor.run`, the source surface can be completely out-of-bounds on the x-axis (but not on the y-axis) by way of a negative offset. This results in an overflow of the value controlling the length of the stride. In non-safe optimization modes (consumers compiling with `ReleaseFast` or `ReleaseSmall`), this could potentially lead to invalid memory accesses or corruption. This issue is patched in version 0.6.1.
Classification
CVE ID: CVE-2025-46333
CVSS Base Severity: HIGH
CVSS Base Score: 7.3
CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Problem Types
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or WraparoundAffected Products
Vendor: vancluever
Product: z2d
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.01% (probability of being exploited)
EPSS Percentile: 1.71% (scored less or equal to compared to others)
EPSS Date: 2025-05-24 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-46333https://github.com/vancluever/z2d/security/advisories/GHSA-mm4c-p35v-7hx3
https://github.com/vancluever/z2d/issues/104
https://github.com/vancluever/z2d/issues/105