CVE-2025-62813VulnerabilityPublished 23 Oct 2025Updated 29 Oct 2025

CVE-2025-62813: LZ4

Affects LZ4Source CVE Database V5

Not known to be exploited · CVSS 5.9 Medium.

Data as of 5 Nov 2025, 05:28 UTC

CVSS 3.1 base score

5.9Medium

How severe the flaw is on the 0–10 CVSS scale.

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector: Local
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Changed
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: High: A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 23 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

1. Monitor official LZ4 project channels and security advisories for patches or updates addressing CVE-2025-62813 and apply them promptly once available. 2. Restrict local access to systems running LZ4, enforcing strict access controls and monitoring for unauthorized local logins or privilege escalations. 3. Implement system resource limits and watchdog mechanisms to detect and recover from potential denial of service conditions caused by LZ4 exploitation. 4. Conduct internal audits to identify all instances of LZ4 usage within organizational infrastructure, including embedded systems and third-party software dependencies. 5. Employ host-based intrusion detection systems (HIDS) to monitor anomalous behavior related to compression operations or system crashes. 6. Educate staff about the risks of local exploitation and enforce policies to minimize insider threats and unauthorized physical access. 7. Consider network segmentation to isolate critical systems that use LZ4, limiting the potential impact of local attacks spreading across the network. 8. Prepare incident response plans specifically addressing availability disruptions linked to compression library vulnerabilities.

Impact

For European organizations, the primary impact of CVE-2025-62813 is the potential for denial of service conditions on systems utilizing the LZ4 compression library. This could affect software applications, embedded devices, or infrastructure components that rely on LZ4 for data compression. Critical sectors such as telecommunications, manufacturing, automotive, and cloud service providers that embed LZ4 in their technology stacks may experience service interruptions or system instability. The local attack vector limits exploitation to insiders or attackers with physical or remote local access, which somewhat reduces the risk from external attackers but raises concerns about insider threats or compromised local accounts. The scope change implies that exploitation could affect broader system components, potentially leading to cascading failures or impacting availability of critical services. The absence of confidentiality or integrity impact means data breaches or data manipulation are unlikely, but operational disruptions could have significant business and safety consequences. European organizations with stringent availability requirements, such as financial institutions or healthcare providers, should be particularly vigilant.

Summary

CVE-2025-62813 is a recently published vulnerability affecting the LZ4 compression library, a widely used open-source tool for fast data compression and decompression. The vulnerability is characterized by a CVSS 3.1 vector indicating local attack vector (AV:L), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), and a scope change (S:C). The impact is limited to availability (A:H), meaning exploitation can cause denial of service or system crashes without compromising confidentiality or integrity. The absence of affected versions and patch information suggests the vulnerability was identified recently and may still be under investigation or remediation. The local attack vector implies that an attacker must have local access to the system to exploit the vulnerability, which raises the attack complexity. The scope change indicates that the vulnerability affects resources beyond the initially vulnerable component, potentially impacting the entire system or other components. No known exploits have been reported in the wild, which reduces immediate risk but does not eliminate the threat. LZ4 is commonly embedded in various software products, operating systems, and hardware devices for efficient compression, making this vulnerability relevant to a broad range of applications. The lack of detailed technical information limits precise exploitation scenarios, but the availability impact suggests potential for denial of service attacks that could disrupt services relying on LZ4 compression.

Community reviews

Loading reviews…