Medium severity5.6OSV Advisory· Published May 6, 2025· Updated Apr 15, 2026

CVE-2025-47256

Description

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Libxmp/LibxmpOSV2 versions
2.2.0, 2.3.0, 2.3.1, …+ 1 more
- (no CPE)range: 2.2.0, 2.3.0, 2.3.1, …
- (no CPE)range: <=4.6.2
osv-coords
pkg:rpm/opensuse/libxmp&distro=openSUSE%20Tumbleweed
Range: < 4.6.3-1.1

Patches

Vulnerability mechanics

References

github.com/libxmp/libxmp/blob/ec22d1c7b93c8f681f8504a6c61c6f8a52458a10/src/loaders/prowizard/pha.cnvd
github.com/libxmp/libxmp/issues/847nvd

News mentions

No linked articles in our index yet.

cvss	0.364
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000