by Kastro
Paper/Archive/CVE-2025-40914

CVE-2025-40914

MIK CryptX — Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.4.454 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow. CryptX embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.

Affected

ProductAffectedFixed inSource
CryptX0.002 – 0.086–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcve.org/CVERecord?id=CVE-2023-36328refgithub.com/libtom/libtommath/pull/546refgithub.com/advisories/GHSA-j3xv-6967-cv88refmetacpan.org/release/MIK/CryptX-0.086/source/src/ltm/bn_mp_grow.c