Out-of-bounds read in Adobe XMP-Toolkit-SDK - CVE-2025-30308

Vulnerability identifier: #VU107314

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-30308

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

Adobe XMP-Toolkit-SDK
openEuler
exempi-devel
exempi-debugsource
exempi-debuginfo
exempi-help
exempi

Install updates from vendor's website.

Adobe XMP-Toolkit-SDK - update to 2025.03
exempi-devel - addressed in versions 2.4.5-6, 2.5.2-5, 2.6.4-2
exempi-debugsource - addressed in versions 2.4.5-6, 2.5.2-5, 2.6.4-2
exempi-debuginfo - addressed in versions 2.4.5-6, 2.5.2-5, 2.6.4-2
exempi-help - addressed in versions 2.4.5-6, 2.5.2-5, 2.6.4-2
exempi - addressed in versions 2.4.5-6, 2.5.2-5, 2.6.4-2

• https://helpx.adobe.com/security/products/xmpcore/apsb25-34.html

• Multiple vulnerabilities in Adobe XMP Toolkit SDK
• openEuler 24.03 LTS SP1 update for exempi
• openEuler 22.03 LTS SP4 update for exempi
• openEuler 22.03 LTS SP3 update for exempi
• openEuler 20.03 LTS SP4 update for exempi
• openEuler 24.03 LTS SP2 update for exempi
• openEuler 24.03 LTS update for exempi