There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1
CVSS Details
- CVSS 4.0 Base Score: 5.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade abseil-cpp-debuginfoUpgrade abseil-cpp-develUpgrade abseil-cppUpgrade abseil-cpp-debugsource | Jun 24, 2025 | Feb 21, 2025 |
| Debian | — | Upgrade abseil | Apr 7, 2025 | Feb 21, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade abseil-cpp | Jun 13, 2025 | Feb 21, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade abseil-cpp | Jun 11, 2025 | Feb 21, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade abseil-cpp | Jul 1, 2025 | Feb 21, 2025 |
| Suse | — | Upgrade libabsl2401_0_0-32bitUpgrade libabsl2401_0_0Upgrade abseil-cpp-devel | Jan 30, 2026 | Jan 20, 2026 |
| Ubuntu | — | Upgrade libabsl20230802Upgrade libabsl20210324Upgrade libabsl20220623t64 | May 15, 2025 | Feb 21, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Feb 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub