CVE-2025-2509

May 6, 2025, 2:15 p.m.

7.8
High

Description

Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosvm sandboxed process, potentially leading to VM escape via crafted vertex elements data triggering an out-of-bounds read in util_format_description.

Product(s) Impacted

Vendor Product Versions
Virglrenderer
  • Chromeos
  • 16093.57.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-125
Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a virglrenderer chromeos 16093.57.0 / / / / / / /

References

https://issues.chromium.org/issues/b/385851796
https://issuetracker.google.com/issues/385851796

Tags

CWE-125
7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f
2025-05-06
CVE-2025-2509

CVSS Score

7.8 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    View Vector String

Timeline

Published: May 6, 2025, 1:15 a.m.
Last Modified: May 6, 2025, 2:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.