CVE-2025-55286
BaseFortify
Publication date: 2025-08-16
Last updated on: 2025-08-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vancluever | z2d | 0.7.0 |
| vancluever | z2d | 0.7.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the z2d graphics library version 0.7.0, which introduced a new multi-sample anti-aliasing (MSAA) method using a new buffering mechanism for coverage data. When drawing paths that are partially or fully outside the rendering surface, incorrect bounding calculations can cause out-of-bounds access within the coverage buffer. This affects certain drawing operations when using .default or .multisample_4x anti-aliasing modes, potentially leading to invalid memory accesses or memory corruption in non-safe optimization modes.
How can this vulnerability impact me? :
The vulnerability can lead to invalid memory accesses or memory corruption when using affected drawing operations with specific anti-aliasing modes in non-safe optimization builds. This could cause application crashes, unexpected behavior, or potentially exploitable conditions depending on how the library is used in your software.
What immediate steps should I take to mitigate this vulnerability?
Upgrade z2d to version 0.7.1 immediately, skipping version 0.7.0, as it fixes the vulnerability. Avoid using the affected version 0.7.0 and consider disabling the .default or .multisample_4x anti-aliasing modes if upgrading is not immediately possible.