CVE-2025-26304
Libming 0.4.8
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NSummary
CVE-2025-26304 is a high-severity Heap Inspection (CWE-244) vulnerability in Libming Libming. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-26304 is a memory leak vulnerability identified in the parseSWF_EXPORTASSETS function within util/parser.c of libming version 0.4.8. This issue, published on 2025-02-20, is classified under CWE-244 and carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity primarily due to its potential for information disclosure.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges or user interaction. Successful exploitation allows attackers to achieve high-impact confidentiality loss through memory leakage, alongside low-impact integrity modification, without affecting availability or changing the scope of impact.
For mitigation details, refer to the advisory in the GitHub issue at https://github.com/libming/libming/issues/323.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4484
Vulnerability Data
A memory leak has been identified in the parseSWF_EXPORTASSETS function in util/parser.c of libming v0.4.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-4 requires mechanisms that stop unintended transfer of sensitive data through shared resources such as heap memory reused after realloc.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicitly requires secure deletion of sensitive data, directly addressing improper heap clearing.
Secure SDLC processes can incorporate memory-safety requirements but do not specifically mandate heap clearing.
Mandates secure coding practices that include proper memory sanitization before release.
Secure architecture principles may reduce exposure but do not prescribe explicit heap-clearing techniques.