CVE-2025-1122
published 2025-04-15CVE-2025-1122: Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gain persistence and…
PriorityP433medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
EPSS
0.22%
12.6th percentile
Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gain persistence and
Bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | — | — | |
| chromeos | >= 15753.50.0 < 15753.50.0 | 15753.50.0 |
CVSS provenance
nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ghsa9.3CRITICAL
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
ghsa·2025-10-28·CVSS 8.8
CVE-2025-62171 [HIGH] CWE-190 ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)
## Summary
CVE-2025-57803 claims to be patched in ImageMagick 7.1.2-2, but **the fix is incomplete and ineffective**. The latest version **7.1.2-5 remains vulnerable** to the same integer overflow attack.
The patch added `BMPOverflowCheck()` but placed it **after** the overflow occurs, making it useless. A malicious 58-byte BMP file can trigger AddressSanitizer crashes and DoS.
**Affected Versions:**
- ImageMagick columns * bmp_info.bits_per_pixel; // OVERFLOW!
// Line 1121: Uses already-overflowed value
bytes_per_line = 4*((extent+31)/32);
// Line 1122: Checks the RESULT, not the multiplication
if (BMPOverflowCheck(bytes_per_line, image->rows) != MagickFalse)
ThrowReaderException(CorruptImageError, "InsufficientImageDataInFil
GHSA
GHSA-j93w-j7jm-5c8h: Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122
ghsa_unreviewed·2025-04-15
CVE-2025-1122 [MEDIUM] CWE-787 GHSA-j93w-j7jm-5c8h: Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122
Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access to gain persistence and
bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-04-15
Published