CVE-2025-45331
BaseFortify
Publication date: 2025-06-20
Last updated on: 2025-10-22
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ricko | brplot | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as segmentation faults or program crashes in the brplot application, specifically related to the function br_dagens_handle_once. Detection can be done by monitoring the brplot application logs for crashes or segmentation faults. Additionally, running the brplot application under a debugger or using tools like AddressSanitizer or Valgrind can help detect null pointer dereferences. There are no specific network commands to detect this vulnerability as it is a local application crash issue. [1, 2]
Can you explain this vulnerability to me?
This vulnerability is a Null Pointer Dereference (NPD) in the brplot software, specifically in the function br_dagens_handle_once. The function processes data elements and retrieves pointers to data structures. If a pointer 'd' is NULL, the code later tries to access 'd->group_id' without checking if 'd' is NULL, causing the program to crash or behave unpredictably due to dereferencing a NULL pointer. [1, 2]
How can this vulnerability impact me? :
This vulnerability can cause the brplot program to crash or exhibit unpredictable behavior, such as segmentation faults. This can lead to denial of service or interruption of data processing tasks relying on brplot, potentially affecting system stability or availability. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the patch that adds a null pointer check before dereferencing the pointer 'd' in the br_dagens_handle_once function. Specifically, ensure that the code checks if 'd' is not NULL before calling br_data_clear. If a patch is not available, avoid running the vulnerable version of brplot or restrict its usage until the fix is applied. [1]