CVE-2025-3017

MEDIUM

TA-Lib <= 0.6.4 - Out-of-Bounds Write in setInputBuffer

Title source: llm
STIX 2.1

Description

A vulnerability, which was classified as critical, has been found in TA-Lib up to 0.6.4. This issue affects the function setInputBuffer of the file src/tools/ta_regtest/ta_test_func/test_minmax.c of the component ta_regtest. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5879180e9070ec35d52948f2f57519713256a0f1. It is recommended to apply a patch to fix this issue.

References (7)

Core 7
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.302069
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.302069
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.524603
Issue Tracking issue-tracking
https://github.com/TA-Lib/ta-lib/issues/61
Issue Tracking issue-tracking
https://github.com/TA-Lib/ta-lib/pull/62
Issue Tracking exploit issue-tracking
https://github.com/TA-Lib/ta-lib/issues/61#issue-2931609110

Scores

CVSS v3 5.3
EPSS 0.0016
EPSS Percentile 5.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-119 CWE-787
Status published
Products (5)
n/a/TA-Lib 0.6.0
n/a/TA-Lib 0.6.1
n/a/TA-Lib 0.6.2
n/a/TA-Lib 0.6.3
n/a/TA-Lib 0.6.4
Published Mar 31, 2025
Tracked Since Feb 18, 2026