CVE-2025-46333: z2d OOB composition could lead to invalid memory access and corruption
First published: Fri Apr 25 2025(Updated: )
z2d is a pure Zig 2D graphics library. In version 0.6.0, when writing from one surface to another using `z2d.compositor.StrideCompositor.run`, the source surface can be completely out-of-bounds on the x-axis (but not on the y-axis) by way of a negative offset. This results in an overflow of the value controlling the length of the stride. In non-safe optimization modes (consumers compiling with `ReleaseFast` or `ReleaseSmall`), this could potentially lead to invalid memory accesses or corruption. This issue is patched in version 0.6.1.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| z2d z2d | >0.5.1<=0.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-46333?
CVE-2025-46333 has a moderate severity due to the potential for out-of-bounds write vulnerabilities.
What versions of z2d are affected by CVE-2025-46333?
CVE-2025-46333 affects z2d versions prior to 0.6.1.
How do I fix CVE-2025-46333?
To fix CVE-2025-46333, upgrade z2d to version 0.6.1 or later.
What causes the vulnerability CVE-2025-46333?
CVE-2025-46333 is caused by a negative offset during surface writing in the `z2d.compositor.StrideCompositor.run` method.
What impact does CVE-2025-46333 have on applications using z2d?
CVE-2025-46333 can lead to data corruption or crashes in applications that utilize the affected versions of the z2d library.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- agent/source
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/description
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/z2d
- canonical/z2d z2d