Threats tagged 'brew-keeper-commander-cve-2025-64076'

CVE-2025-64076 is a high-severity vulnerability in the cbor2 library's C extension decoder affecting versions prior to 5.7.1. It involves an integer underflow causing out-of-bounds reads and a memory leak due to missing reference count releases. These flaws can be exploited remotely by sending crafted CBOR data with multi-byte UTF-8 characters at specific chunk boundaries, leading to denial of service via process crashes or memory exhaustion. The issue affects applications using cbor2's C extension to process untrusted CBOR data, such as web APIs and IoT data collectors. The vulnerability is fixed in version 5.7.1.