CVE-2025-66909
BaseFortify
Publication date: 2025-12-19
Last updated on: 2025-12-19
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| turms | turms_ai_serving | 0.10.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-409 | The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an image decompression bomb denial of service in the Turms AI-Serving module v0.10.0-SNAPSHOT and earlier. The ExtendedOpenCVImage class loads images using OpenCV's imread() function without validating image dimensions or pixel count before decompression. An attacker can upload a specially crafted compressed image file that is small in size but expands to consume gigabytes of memory when decompressed. This causes memory exhaustion, leading to an OutOfMemoryError and crashing the service. No authentication is required if the OCR service is publicly accessible, allowing multiple requests to cause a complete denial of service.
How can this vulnerability impact me? :
This vulnerability can cause immediate memory exhaustion on the server running the Turms AI-Serving module, resulting in service crashes and denial of service. If the OCR service is publicly accessible, attackers can exploit this by sending multiple specially crafted images, potentially making the service completely unavailable to legitimate users.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should restrict or disable public access to the OCR service to prevent unauthenticated attackers from uploading malicious images. Additionally, implement validation checks on image dimensions and pixel counts before decompression to avoid memory exhaustion. Monitoring and limiting the size of uploaded images can also help prevent exploitation.