Abc EUVD-2025-19136

The CVSS 3.1 score of 7.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates HIGH severity in standardized metrics. Attack Vector is Network (remotely exploitable), Attack Complexity is Low (no special conditions required), no privileges or user interaction needed—these are concerning baseline factors. However, the impact is limited to Availability (denial of service only); there is no Confidentiality or Integrity impact, which constrains real-world damage. Without confirmed EPSS score, KEV/CISA acknowledgment, or public proof-of-concept data provided, the true exploitation likelihood remains uncertain. The practical risk depends on deployment context: if ABC is embedded in automated EDA pipelines or cloud-based synthesis services exposed to untrusted input, the risk is HIGH (DoS directly impacts business continuity). If ABC is used only offline in controlled environments by trusted engineers, risk is MEDIUM-LOW. The lack of exploitability data suggests this may be a recently disclosed vulnerability with limited real-world attack evidence. Recommendation: Treat as MEDIUM-HIGH priority for organizations using ABC in production/internet-facing workflows, but not critical unless KEV or active exploitation is confirmed.

An attacker sends a crafted circuit design file (e.g., BLIF, AIGER, or Verilog format) to a system running Berkeley ABC, specifically one that triggers the FRAIG or CEC logic with a malformed network topology. The vulnerability exists in the Abc_NtkCecFraigPart function, which may receive a null pointer from upstream processing when handling certain graph structures (e.g., circuits with disconnected components, zero-node networks, or specially crafted hierarchies). The function dereferences this null pointer without validation, causing an immediate segmentation fault. If ABC is exposed as a web service (e.g., a cloud synthesis tool), the attacker can remotely submit the malicious file via HTTP/API, crashing the service and causing denial of service. The low attack complexity means no special encoding or bypass techniques are required—simple structural anomalies in the input file suffice. No proof-of-concept has been publicly disclosed at this time, but the attack requires only network access and the ability to submit circuit files, both of which are often available to unauthenticated users in integrated EDA platforms.