Cyber Resilience

CVE-2025-47153

Published
01 May 2025
Modified
17 June 2026
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
EPSS Score 0.0038 31th percentile
Risk Priority 50 floored blend · peak EPSS

Summary

CVE-2025-47153 is a medium-severity Reliance on Machine-Dependent Data Representation (CWE-1102) vulnerability in Debian GNU (inferred from references). Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-15 (Development Process, Standards, and Tools) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library,…

more

but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.

CWE(s)
CWE-1102

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Debian
GNU
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V16.2.2

Mitigating Controls (NIST 800-53 r5) AI

SA-15 Development Process, Standards, and Tools partial match

Documented development standards and tools can mandate portable data representations and ban low-level machine-specific constructs.

SA-8 Security and Privacy Engineering Principles partial match

Engineering principles can require portable data abstractions and forbid machine-dependent assumptions in code.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include code reviews and portability checks that prevent machine-dependent data representation assumptions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect platform-specific representation issues but does not itself prevent their introduction.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle mandates portable, architecture-independent coding practices that reduce reliance on machine-specific data representations.

A.8.27 Secure system architecture and engineering principles partial match
degrades

Secure system architecture and engineering principles require designs that abstract away low-level, platform-dependent constructs.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly prohibit or flag use of machine-dependent data representations, directly mitigating this weakness.

References