CVE-2025-40914 — Dependency on Vulnerable Third-Party Component in Libcryptx-perl

CWE-1395 — Dependency on Vulnerable Third-Party Component6 documents5 sources
Severity
9.8CRITICALNVD
EPSS
0.5%
top 32.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Debian Libcryptx-perlMsrc Azl3 TCL 8.6.13-3 ON Azure Linux 3.0Msrc Cbl2 TCL 8.6.13-3 ON CBL Mariner 2.0
Timeline
PublishedJun 11
Latest updateMar 26

Description

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow. CryptX embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/libcryptx-perl< libcryptx-perl 0.087-1 (forky)

🔴Vulnerability Details

2
OSV
libcryptx-perl vulnerabilities↗2026-03-26
▶
OSV
CVE-2025-40914: Perl CryptX before version 0↗2025-06-11
▶

📋Vendor Advisories

3
Ubuntu
CryptX vulnerabilities↗2026-03-26
▶
Microsoft
Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow↗2025-06-10
▶
Debian
CVE-2025-40914: libcryptx-perl - Perl CryptX before version 0.087 contains a dependency that may be susceptible t...↗2025
▶
CVE-2025-40914 — Debian Libcryptx-perl vulnerability | cvebase