CVE-2025-4638 — CRITICAL (9.8)

Q: How severe is CVE-2025-4638?

CVE-2025-4638 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2025-4638?

Check the references section above for vendor advisories and patch information. Affected products include: Pointclouds Point Cloud Library.

Vulnerability Description

A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-dependent attackers to cause undefined behavior by exploiting improper pointer arithmetic. Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITH_SYSTEM_ZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Pointclouds	Point Cloud Library	< 1.14.0

Related Weaknesses (CWE)

CWE-119

References

FAQ

What is CVE-2025-4638?

CVE-2025-4638 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-dependent attackers to cause undefined behavio...

How severe is CVE-2025-4638?

CVE-2025-4638 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-4638?

Check the references section above for vendor advisories and patch information. Affected products include: Pointclouds Point Cloud Library.