CVE-2025-40914CWE-1395

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow

Critical · published June 11, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

🔥 An integer overflow in Perl CryptX could leave your cryptographic shield wide open. This vulnerability stems from a dependency on the libtommath library, which means a crafty attacker might exploit it! Think of it like a water reservoir that overflows when too much pressure builds up — if the lid snaps, the water (or sensitive data) can spill everywhere, creating chaos. If left unaddressed, an attacker could leverage this overflow to manipulate data, potentially leading to critical security breaches. This could put sensitive information at risk and compromise the integrity of your applications — absolutely devastating!

Put simply

Think of it like a water reservoir that overflows when too much pressure builds up — if the lid snaps, the water (or sensitive data) can spill everywhere, creating chaos. This vulnerability arises from an integer overflow within the libtommath library, embedded in Perl CryptX before version 0.087, making it susceptible to unexpected overflow behaviors and subsequent exploitation.

What to do

If left unaddressed, an attacker could leverage this overflow to manipulate data, potentially leading to critical security breaches. This could put sensitive information at risk and compromise the integrity of your applications — absolutely devastating! Upgrade Perl CryptX to version 0.087 or later immediately to mitigate this risk. Additionally, review your dependencies and ensure they're all up to date to avoid similar pitfalls in the future. You've got this! By taking these steps, you'll bolster your security defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00538 · 44.5th percentile
Weakness
CWE-1395 · Dependency on Vulnerable Third-Party Component
Published
2025-06-11T14:06Z
EPSS history
Timeline
  • 11 JUN 14:06Z
    Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow
    cvelistv5