CVE-2025-53367
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2025-53367. We'll provide specific mitigation strategies based on your environment and risk profile.
Description
DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.
Available Exploits
Related News
DjVuLibre has a vulnerability that could enable an attacker to gain code execution on a Linux Desktop system when the user tries to open a crafted document. The post CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre appeared first on The GitHub …
Posted by Kevin Backhouse on Jul 03DjVuLibre version 3.5.29 was released today. It fixes CVE-2025-53367 (GHSL-2025-055), an out-of-bounds write in the MMRDecoder::scanruns method. The vulnerability could be exploited to gain code execution on a Linux Desktop …
EU Vulnerability Database
Monitored by ENISA for EU cybersecurity
ENISA Analysis
DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.
Affected Products (ENISA)
ENISA Scoring
CVSS Score (4.0)
EPSS Score
ENISA References
Data provided by ENISA EU Vulnerability Database. Last updated: July 3, 2025