vBulletin CVE-2025-46171

Exploitation requires the attacker to hold an authenticated session on the target vBulletin 3.8.7 forum - anonymous/unauthenticated access is insufficient, contradicting the provided CVSS PR:N metric. The attacker must also have accumulated a sufficiently large buddy list within their account, which is a self-provisioned pre-condition that may require time or automated bulk-add actions. The forum must be running vBulletin specifically at version 3.8.7 on a PHP environment without restrictive memory or execution-time caps. Exploitation is limited by the need for prior account registration (which may require admin approval on private forums), the time needed to build a large buddy list, and the absence of any code execution or data exfiltration path - impact is limited to crashing the forum service. Shared-hosting deployments may confine the memory exhaustion to the PHP process sandbox rather than the entire host.

Real-world risk is moderate-to-low. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) contains significant inconsistencies with the vulnerability description: PR:N implies unauthenticated access, yet the description explicitly requires an authenticated user with a pre-populated buddy list; and A:N (no availability impact) is irreconcilable with a denial-of-service that crashes the forum - this is the primary stated impact. The C:L/I:L scores likewise have no grounding in the description. These metric choices appear erroneous and should not be trusted for prioritization. EPSS at 0.25% (16th percentile) reflects low exploitation activity, consistent with the very narrow affected version footprint. The product version (3.8.7) is extremely outdated, constraining exposure to legacy unpatched installations. The publicly available PoC on GitHub lowers the barrier for exploitation against those remaining installations. An attacker must first register and authenticate, then build a large buddy list - this is a self-setup condition that adds real friction. The attack does not yield code execution, credential theft, or data exfiltration; impact is limited to availability.

An attacker registers a legitimate account on a vBulletin 3.8.7 forum, populates their buddy list to a threshold that causes excessive memory allocation on the server, and then repeatedly requests the misc.php?do=buddylist endpoint. A publicly available proof-of-concept on GitHub documents the technique. Each request consumes server memory proportional to buddy list size; sustained or concurrent requests exhaust available memory, crashing the forum process and rendering the site unavailable to all users.