EUVD-2025-18796
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
5Description
A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component.
Analysis
A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component.
Technical Context
A NULL pointer dereference occurs when the application attempts to use a pointer that has not been initialized or has been set to NULL. This vulnerability is classified as Improper Resource Shutdown or Release (CWE-404).
Affected Products
Affected products: Pocoproject Poco
Remediation
A vendor patch is available — apply it immediately. Add NULL checks before pointer dereference operations. Use static analysis to identify potential NULL pointer issues. Enable compiler warnings.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| plucky | ignored | end of life, was needs-triage |
| upstream | needs-triage | - |
| trusty | needs-triage | - |
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| oracular | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
Debian
Bug #1108157| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 1.10.0-6+deb11u1 | - |
| bullseye (security) | vulnerable | 1.10.0-6+deb11u2 | - |
| bookworm | vulnerable | 1.11.0-3+deb12u1 | - |
| trixie | vulnerable | 1.13.0-6 | - |
| forky, sid | fixed | 1.14.2-3 | - |
| experimental | fixed | 1.14.2-1 | - |
| (unstable) | fixed | 1.14.2-2 | - |
Share
External POC / Exploit Code
Leaving vuln.today