CVE-2025-29487

HighPublic PoC

Published: 27 March 2025

Published

27 March 2025

Modified

01 April 2025

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0047 64.7th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-29487 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Libming Libming. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 35.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Timely identification, reporting, and correction of flaws like the out-of-memory error in libming's parseABC_STRING_INFO directly prevents DoS exploitation by patching or removing the vulnerable component.

SI-10 Information Input Validation good match

prevent

Validating inputs to the libming parser prevents malicious ABC_STRING_INFO data from triggering excessive memory allocation and allocator exhaustion.

SC-5 Denial-of-service Protection good match

prevent

Denial-of-service protections at system entry points mitigate remote network exploitation leading to process crashes from resource exhaustion in libming.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Out-of-memory error and memory leaks in libming during SWF parsing enable denial of service via resource exhaustion, specifically through exploitation of the application.

NVD Description

An out-of-memory error in the parseABC_STRING_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to allocator exhaustion.

Deeper analysisAI

CVE-2025-29487, published on 2025-03-27, is an out-of-memory error in the parseABC_STRING_INFO function of libming version 0.4.8. This flaw enables attackers to trigger a Denial of Service (DoS) condition through allocator exhaustion, as classified under CWE-400 (Uncontrolled Resource Consumption). The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for significant availability disruption.

Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges, user interaction, or special scoping changes. Exploitation involves crafting malicious input that causes excessive memory allocation during parsing, leading to process crashes or resource exhaustion and denying service to legitimate users of affected libming-dependent applications.

Advisories and related resources include a GitHub issue tracking the problem at https://github.com/libming/libming/issues/330 and a proof-of-concept repository at https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz6.readme, which may provide further details on reproduction and potential fixes. No specific patches or mitigations are outlined in the core CVE description.