CVE-2025-30403

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-11 · updated 2026-06-17

Description

A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00.

Affected products

Facebook mvfst: from v2025.03.24.00 before v2025.07.07.00 — fixed in v2025.07.07.00

How to fix

Upgrade to a fixed version: Facebook mvfst v2025.07.07.00. Check the vendor advisory for mitigations.

References

https://github.com/facebook/mvfst/commit/65b297332191de6e867c4a3139a233fc84c0e7e0
https://www.facebook.com/security/advisories/cve-2025-30403

Get alerted when CVE-2025-30403 or the next vulnerability affects your stack