CVE-2025-2175 Overview
CVE-2025-2175 is an integer overflow vulnerability in libzvbi versions up to 0.2.43, an open source library for decoding VBI (Vertical Blanking Interval) data such as teletext and closed captions. The flaw resides in the _vbi_strndup_iconv function and can be triggered remotely when the library processes attacker-controlled input. The maintainer released version 0.2.44 to address the issue after being notified privately. The vulnerability is categorized under [CWE-190] Integer Overflow and [CWE-189] Numeric Errors.
Critical Impact
Remote attackers can trigger an integer overflow in _vbi_strndup_iconv that may lead to memory corruption or application crashes in software linking against libzvbi.
Affected Products
- zapping-vbi zvbi versions up to and including 0.2.43
- Applications and Linux distributions bundling libzvbi for teletext, subtitle, or closed-caption processing
- Multimedia frameworks and TV capture tools that depend on libzvbi for VBI decoding
Discovery Timeline
- 2025-03-11 - CVE-2025-2175 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2175
Vulnerability Analysis
The vulnerability affects the _vbi_strndup_iconv function within libzvbi, a widely deployed library for parsing VBI data streams. _vbi_strndup_iconv duplicates a string while performing character set conversion through iconv. During size calculations for the destination buffer, arithmetic operations on attacker-influenced length values overflow the fixed-width integer type used to track the buffer size.
When the overflow occurs, the function computes a buffer size smaller than the data actually written after conversion. Downstream allocation and copy operations then treat the truncated size as valid, producing memory corruption conditions such as heap out-of-bounds writes or application termination. The issue was reported responsibly and the maintainer patched it in version 0.2.44.
Root Cause
The root cause is unchecked integer arithmetic on length parameters passed into _vbi_strndup_iconv. Multiplications or additions used to determine the output buffer size wrap around when the input length approaches the limits of the integer type. This produces an undersized allocation relative to the number of bytes the iconv conversion ultimately writes.
Attack Vector
Exploitation requires an attacker to supply crafted VBI or subtitle data that reaches a caller of _vbi_strndup_iconv. Because libzvbi is invoked by media applications processing broadcast streams, capture files, or user-supplied media, the attack surface is reachable over the network through malicious media files or streams. Successful triggering requires user interaction such as opening a crafted file or subscribing to a hostile stream.
No verified proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-g7cg-7gw9-v8cf for technical details.
Detection Methods for CVE-2025-2175
Indicators of Compromise
- Unexpected crashes, segmentation faults, or SIGABRT events in processes linked against libzvbi when processing subtitle or teletext data.
- Media player or capture-tool coredumps referencing _vbi_strndup_iconv or nearby libzvbi symbols in the stack trace.
- Malformed VBI streams or media files delivered to endpoints that subsequently exhibit anomalous memory usage.
Detection Strategies
- Inventory hosts and container images for installed libzvbi packages with version less than or equal to 0.2.43 using package managers such as dpkg, rpm, or SBOM tooling.
- Enable core dump collection and monitor for crashes in binaries that dynamically link libzvbi.so.
- Use compiler sanitizers such as AddressSanitizer and UndefinedBehaviorSanitizer in test environments to detect the overflow on suspect inputs.
Monitoring Recommendations
- Track process crash telemetry from EDR tooling on Linux systems running media, broadcast, or accessibility software that depends on libzvbi.
- Monitor software composition analysis (SCA) reports for the zapping-vbi:zvbi component against advisory GHSA-g7cg-7gw9-v8cf.
- Alert on new file downloads of teletext, DVB, or subtitle content from untrusted sources on systems that process VBI data automatically.
How to Mitigate CVE-2025-2175
Immediate Actions Required
- Upgrade libzvbi to version 0.2.44 or later on all affected systems and rebuild any statically linked applications.
- Identify downstream packages that bundle libzvbi and apply distribution updates as soon as vendor packages become available.
- Restrict processing of untrusted VBI, teletext, or subtitle inputs on servers and workstations until the patched library is deployed.
Patch Information
The maintainer released the fix in libzvbi v0.2.44. Full technical details are documented in the GitHub Security Advisory GHSA-g7cg-7gw9-v8cf and tracked in VulDB #299204.
Workarounds
- Disable teletext, closed-caption, or VBI decoding features in applications where the functionality is not required.
- Sandbox media processing workloads using seccomp, AppArmor, or containerization to limit the impact of memory corruption.
- Avoid opening untrusted broadcast captures, .ts streams, or subtitle files on systems where libzvbi cannot yet be updated.
# Verify installed libzvbi version and upgrade on Debian/Ubuntu
dpkg -l | grep -i zvbi
sudo apt-get update && sudo apt-get install --only-upgrade libzvbi0
# Verify installed libzvbi version and upgrade on RHEL/Fedora
rpm -q zvbi
sudo dnf upgrade zvbi
# Confirm the runtime version is 0.2.44 or later
strings /usr/lib/x86_64-linux-gnu/libzvbi.so.0 | grep -i "0\.2\."
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
