CVE-2025-4638: Improper Pointer Arithmetic in pcl
First published: Wed May 14 2025(Updated: )
A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-dependent attackers to cause undefined behavior by exploiting improper pointer arithmetic. Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITH_SYSTEM_ZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib.
Credit: cve_disclosure@tech.gov.sg
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PointCloudLibrary | <1.14.0 | |
| Zlib | <1.14.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-4638?
CVE-2025-4638 has a high severity due to its potential to cause undefined behavior in applications using the affected zlib library.
How do I fix CVE-2025-4638?
To fix CVE-2025-4638, upgrade the PointCloudLibrary and zlib to versions above 1.14.0.
What components are affected by CVE-2025-4638?
CVE-2025-4638 affects the inftrees.c component of the zlib library within PointCloudLibrary.
Who can exploit CVE-2025-4638?
Context-dependent attackers can exploit CVE-2025-4638 through improper pointer arithmetic vulnerabilities.
What applications are at risk from CVE-2025-4638?
Applications that utilize versions of PointCloudLibrary and zlib below 1.14.0 are at risk from CVE-2025-4638.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/severity
- agent/author
- collector/epss-latest
- source/FIRST
- agent/source
- agent/epss
- agent/tags
- collector/nvd-api
- source/NVD
- agent/weakness
- agent/last-modified-date
- agent/event
- vendor/pointcloudlibrary
- canonical/pointcloudlibrary
- vendor/zlib
- canonical/zlib