CVE-2025-30403

HIGH8.1

Description

A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Affected products

Facebook / mvfstv2025.03.24.00 – v2025.07.07.00

References

VENDOR_ADVISORYhttps://www.facebook.com/security/advisories/cve-2025-30403
PATCHhttps://github.com/facebook/mvfst/commit/65b297332191de6e867c4a3139a233fc84c0e7e0

Updated 38m ago · 8 sources