CVE-2025-46171: Medium severity vBulletin vBulletin vulnerability
vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46171?
CVE-2025-46171 is classified as a denial-of-service vulnerability that can crash the vBulletin forum.
How do I fix CVE-2025-46171?
To fix CVE-2025-46171, you should limit the size of the buddy list for authenticated users or consider upgrading to a patched version of vBulletin.
Who is affected by CVE-2025-46171?
CVE-2025-46171 affects users of vBulletin version 3.8.7 with large buddy lists.
What causes the denial-of-service in CVE-2025-46171?
The denial-of-service in CVE-2025-46171 is caused by excessive memory consumption when processing a large buddy list.
Can CVE-2025-46171 be exploited remotely?
CVE-2025-46171 requires authentication, so it can only be exploited by authenticated users of the vBulletin forum.