Which versions of POCO C++ Libraries are affected by CVE-2025-6375?

CVE-2025-6375 is a low-severity vulnerability in poco (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

Is there a public PoC exploit available for CVE-2025-6375?

Yes, a public proof-of-concept exploit is available for CVE-2025-6375. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6375?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

POCO C++ Libraries CVE-2025-6375

Q: What is the CVSS score of CVE-2025-6375?

CVE-2025-6375 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18796 LOW

Improper Resource Shutdown or Release (CWE-404)

2025-06-21 cna@vuldb.com

Denial Of Service Poco Pocoproject

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.3 LOW

Local attack vector, low privileges, no user interaction, only availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 13:19 vuln.today

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.3 (LOW) 1.9 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 21:35 euvd

EUVD-2025-18796

Analysis Generated

Mar 15, 2026 - 21:35 vuln.today

Patch released

Mar 15, 2026 - 21:35 nvd

Patch available

PoC Detected

Sep 18, 2025 - 13:38 vuln.today

Public exploit code

CVE Published

Jun 21, 2025 - 01:15 cve.org

LOW 1.9

CVE Published

Jun 21, 2025 - 01:15 nvd

LOW 3.3

DescriptionCVE.org

A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component.

AnalysisAI

Null pointer dereference in POCO C++ Libraries up to 1.14.1 allows local attackers to cause a denial of service via crafted multipart input. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.05%), indicating limited exploitation likelihood.

Technical ContextAI

The vulnerability resides in the MultipartInputStream function within Net/src/MultipartReader.cpp, part of POCO's networking library for parsing multipart/form-data streams. The root cause is a null pointer dereference (CWE-404) triggered when boundary validation fails, leading to a crash. The affected CPE is cpe:2.3:a:pocoproject:poco:*:*:*:*:*:*:*:*, covering all versions up to 1.14.1.

RemediationAI

Upgrade to POCO version 1.14.2 or later, which contains the fix commit 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. No workarounds are documented; however, restricting local access to applications using POCO's multipart parsing may reduce risk. The patch is available from the vendor's GitHub repository.

More in Poco

View all

CVE-2025-45766 HIGH This Month POC

7.0 Aug 06

poco v1.14.1-release was discovered to contain weak encryption. Rated high severity (CVSS 7.0), this vulnerability is re

Same weakness CWE-404 – Improper Resource Shutdown or Release

View all

CVE-2018-8120 HIGH POC

7.0

CVE-2025-15687 LOW POC

2.1

CVE-2025-15686 LOW POC

2.1

CVE-2024-0546 HIGH POC

7.5

CVE-2024-31611 CRITICAL POC

9.1

CVE-2025-1103 HIGH POC

7.1

CVE-2022-4066 HIGH POC

8.2

CVE-2025-5867 HIGH POC

8.0

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

Ubuntu

Priority: Medium

poco

Release	Status	Version
plucky	ignored	end of life, was needs-triage
upstream	needs-triage	-
trusty	needs-triage	-
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
jammy	needs-triage	-
noble	needs-triage	-
oracular	ignored	end of life, was needs-triage
questing	needs-triage	-

Debian

Bug #1108157

poco

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	1.10.0-6+deb11u1	-
bullseye (security)	vulnerable	1.10.0-6+deb11u2	-
bookworm	vulnerable	1.11.0-3+deb12u1	-
trixie	vulnerable	1.13.0-6	-
forky, sid	fixed	1.14.2-3	-
experimental	fixed	1.14.2-1	-
(unstable)	fixed	1.14.2-2	-

CVE-2025-6375 vulnerability details – vuln.today

Back

POCO C++ Libraries CVE-2025-6375

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Poco

Same weakness CWE-404 – Improper Resource Shutdown or Release

Same technique Denial Of Service

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code