CVE-2025-4003CWE-404CWE-476

RefindPlusRepo RefindPlus RP_ApfsIo.c InternalApfsTranslateBlock null pointer dereference

Medium · published April 28, 2025

CVSS v4.0
6.8
EPSS
0%
Percentile
9.0
In the wild
Unconfirmed
What it is

A vulnerability was found in RefindPlusRepo RefindPlus 0.14.2.AB. It has been classified as problematic. This affects the function InternalApfsTranslateBlock of the file Library/RP_ApfsLib/RP_ApfsIo.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The patch is named 4d35125ca689a255647e9033dd60c257d26df7cb. It is recommended to apply a patch to fix this issue.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00198 · 9.0th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2025-04-28T05:31Z
EPSS history
Timeline
  • 28 APR 05:31Z
    RefindPlusRepo RefindPlus RP_ApfsIo.c InternalApfsTranslateBlock null pointer dereference
    cvelistv5