What’s Vulnerable › Vulnerabilities

CVE-2025-2509

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-05-06 · updated 2026-06-17
• Weakness: CWE-125

Description

Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosvm sandboxed process, potentially leading to VM escape via crafted vertex elements data triggering an out-of-bounds read in util_format_description.

Affected products

• Google ChromeOS: 16093.57.0

References

• https://issues.chromium.org/issues/b/385851796
• https://issuetracker.google.com/issues/385851796

Get alerted when CVE-2025-2509 or the next vulnerability affects your stack