CVE-2026-107125CWE-119CWE-122

CVE-2026-107125

Medium · published October 7, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00315 · 23.2th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-122 · Heap-based Buffer Overflow
Published
2026-10-07T19:17Z
References (7)
https://newsgroup.xnview.com/viewtopic.php?t=51359 · [email protected]https://vuldb.com/cve/CVE-2026-107125 · [email protected]https://vuldb.com/submit/993948 · [email protected]https://vuldb.com/vuln/414926 · [email protected]https://vuldb.com/vuln/414926/cti · [email protected]https://www.xnview.com/en/xnview/#downloads · [email protected]https://vuldb.com/submit/993948 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 07 OCT 14:15Z
    XnView Classic FLI File heap-based overflow
    cvelistv5