VDB
CVE-2025-6375
CVE-2025-6375
PUBLISHED
CVSS 1.899999976158142 LOW
A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component.
EPSS 0.25% · 15.3th percentile
Risk Scores
CVSS 4.0
1.899999976158142
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score
0.25%
15.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| pocoproject | poco | 0 |
| n/a | poco | 1.14.1, 1.14.2, 1.14.0 |
Timeline
- Jun 21, 2025 EPSS Score
- Jun 21, 2025 Coalition ESS Score
- Jun 21, 2025 CVE Published
- Jun 21, 2025 PoC Published
- Jun 23, 2025 Coalition ESS Score
- Jun 23, 2025 CVE Updated
- Jun 24, 2025 Coalition ESS Score
- Jul 1, 2025 EPSS Score
- Jul 12, 2025 EPSS Score
- Jul 22, 2025 EPSS Score
- Aug 2, 2025 EPSS Score
- Aug 12, 2025 EPSS Score
References
- https://github.com/pocoproject/poco/issues/4915 exploit
- https://github.com/pocoproject/poco/commit/6f2f85913c191ab9ddfb8fae781f5d66afccf3bf exploit
- https://github.com/pocoproject/poco/releases/tag/poco-1.14.2-release exploit
- VDB-313370 | poco MultipartReader.cpp MultipartInputStream null pointer dereference vdb
- VDB-313370 | CTI Indicators (IOB, IOC, IOA) url
- Submit #597446 | Applied Informatics Software Engineering GmbH poco poco 1.14.1 (commit 530c2ef) NULL Pointer Dereference third-party-advisory
- https://github.com/user-attachments/files/19524599/poco_crash.txt exploit
- https://nvd.nist.gov/vuln/detail/CVE-2025-6375 advisory