CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2025-47712: Nbd: nbdkit: integer overflow triggers an assertion resulting in denial of service

Description

A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service.

Classification

CVE ID: CVE-2025-47712

Problem Types

Integer Overflow or Wraparound

Affected Products

Vendor: Red Hat

Product: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 12.66% (scored less or equal to compared to others)

EPSS Date: 2025-06-22 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-47712
https://access.redhat.com/security/cve/CVE-2025-47712
https://bugzilla.redhat.com/show_bug.cgi?id=2365724

Timeline