Cyber Posture

CVE-2025-52930

HighPublic PoC

Published: 25 August 2025

Published
25 August 2025
Modified
03 November 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0039 59.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-52930 is a high-severity Integer Overflow to Buffer Overflow (CWE-680) vulnerability in Sail Sail. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 40.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the heap-based buffer overflow in SAIL library's BMPv3 RLE decoding by identifying, prioritizing, and applying patches or library updates.

prevent

Provides memory protections like ASLR, DEP, and heap cookies to prevent successful exploitation of the heap buffer overflow for remote code execution.

prevent

Validates BMP image inputs prior to decoding to block specially crafted files from reaching the vulnerable RLE decompression function.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Heap buffer overflow in image decoder directly enables client-side RCE via malicious BMP file (T1203); requires user to open crafted file (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decompressing the image data from a specially crafted .bmp file, a heap-based buffer overflow can occur which allows for remote code…

more

execution. An attacker will need to convince the library to read a file to trigger this vulnerability.

Deeper analysisAI

A memory corruption vulnerability, designated CVE-2025-52930, affects the BMPv3 RLE Decoding functionality in the SAIL Image Decoding Library version 0.9.8. The issue manifests as a heap-based buffer overflow during the decompression of image data from a specially crafted .bmp file, potentially enabling remote code execution. Applications or systems that incorporate this library and process BMP files are at risk when the library is instructed to decode malicious input.

The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low attack complexity and no required privileges, though it demands user interaction. An attacker can craft a malicious BMP file and trick a user into opening or processing it via an affected application, such as an image viewer or editor linked against the library. Successful exploitation allows arbitrary code execution with the privileges of the application, potentially leading to full system compromise.

Mitigation details and further technical analysis are available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2221. Security practitioners should review this report for patch information, workarounds, or updated library versions to address the flaw.

Details

CWE(s)

Affected Products

sail
sail
0.9.8

CVEs Like This One

CVE-2025-53510Same product: Sail Sail
CVE-2025-46407Same product: Sail Sail
CVE-2025-52456Same product: Sail Sail
CVE-2025-32468Same product: Sail Sail
CVE-2025-50129Same product: Sail Sail
CVE-2025-53085Same product: Sail Sail
CVE-2025-35984Same product: Sail Sail
CVE-2026-27168Same product: Sail Sail
CVE-2025-54952Shared CWE-680
CVE-2026-25541Shared CWE-680

References