CVE-2025-4638: Improper Pointer Arithmetic in pcl
A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-dependent attackers to cause undefined behavior by exploiting improper pointer arithmetic.
Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITHSYSTEMZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4638?
CVE-2025-4638 has a high severity due to its potential to cause undefined behavior in applications using the affected zlib library.
How do I fix CVE-2025-4638?
To fix CVE-2025-4638, upgrade the PointCloudLibrary and zlib to versions above 1.14.0.
What components are affected by CVE-2025-4638?
CVE-2025-4638 affects the inftrees.c component of the zlib library within PointCloudLibrary.
Who can exploit CVE-2025-4638?
Context-dependent attackers can exploit CVE-2025-4638 through improper pointer arithmetic vulnerabilities.
What applications are at risk from CVE-2025-4638?
Applications that utilize versions of PointCloudLibrary and zlib below 1.14.0 are at risk from CVE-2025-4638.