CVE-2025-50343: Critical severity npm/matio vulnerability
An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in MatVarCreateStruct() when the nfields value does not match the actual number of strings in the fields array. This leads to out-of-bounds reads and invalid memory frees during cleanup, potentially causing a segmentation fault or heap corruption.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-50343?
CVE-2025-50343 has a high severity rating due to its potential to cause heap-based memory corruption and lead to application crashes.
How do I fix CVE-2025-50343?
To fix CVE-2025-50343, ensure that the nfields value in the Mat_VarCreateStruct() function accurately matches the number of strings in the fields array.
Which versions of matio are affected by CVE-2025-50343?
CVE-2025-50343 affects matio version 1.5.28 and possibly earlier versions, as they contain the vulnerability.
What type of vulnerability is CVE-2025-50343?
CVE-2025-50343 is classified as a heap-based memory corruption vulnerability.
Can CVE-2025-50343 lead to data loss?
Yes, CVE-2025-50343 may lead to data loss due to out-of-bounds reads and invalid memory frees.