CVE catalog

CVE-2025-50343

libmatio: CVE-2025-50343

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.41% · Oct 21, 2026

A flaw was found in matio. This vulnerability involves a memory error within the Mat_VarCreateStruct() function, where the system incorrectly handles the number of fields in a data structure. This can lead to out-of-bounds memory access and improper memory cleanup. An attacker could exploit this issue to cause the application to crash, resulting in a denial of service, or potentially to execute unauthorized code on the affected system. This vulnerability is rated Moderate because it involves heap-based memory corruption, which could lead to a denial of service or other impacts. Exploitation requires user interaction, such as opening a specially crafted MAT file, limiting the attack vector. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
DebianlibmatiobookwormNot reportedvulnerable
Debianlibmatiobookworm1.5.23-2+deb12u1fixed
Debianlibmatio121.5.23-2vulnerable
Debianlibmatio121.5.23-2+deb12u1fixed
Debianlibmatio131.5.28-2vulnerable
Debianlibmatio131.5.29-1vulnerable
Debianlibmatio131.5.30-1vulnerable
Debianlibmatio131.5.30-2vulnerable
Debianlibmatio131.5.30-3vulnerable
Debianlibmatio131.5.30-4vulnerable
Debianlibmatio131.6.0-1vulnerable
Debianlibmatio141.5.28-2vulnerable
Debianlibmatio141.5.29-1vulnerable
Debianlibmatio141.5.30-1vulnerable
Debianlibmatio141.5.30-2fixed
Opensusematiotumbleweed1.5.30-1.1fixed
Ubuntulibmatiopro1.5.19-2vulnerable
Ubuntulibmatiopro1.5.21-1vulnerable
Ubuntulibmatiopro1.5.21-1ubuntu0.1~esm1vulnerable
Ubuntulibmatio24.041.5.23-2vulnerable
Ubuntulibmatio24.041.5.24-1vulnerable
Ubuntulibmatio24.041.5.26-1vulnerable
Ubuntulibmatio24.041.5.26-1build1vulnerable
Ubuntulibmatio24.041.5.26-1build2vulnerable
Ubuntulibmatio24.041.5.26-1build3vulnerable
Ubuntulibmatio25.101.5.28-1build1vulnerable
Ubuntulibmatio25.101.5.28-2vulnerable
Ubuntulibmatio26.101.5.30-2vulnerable
Ubuntulibmatio26.101.5.30-4vulnerable
Ubuntulibmatio26.101.5.30-4build1vulnerable
Ubuntulibmatio26.041.5.28-2vulnerable
Ubuntulibmatio26.041.5.29-1vulnerable
Ubuntulibmatio26.041.5.30-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibmatiodebbookworm1.5.23-2+deb12u1Not reportedNot reportedNot reported
Debianlibmatiodeb121.5.23-2+deb12u1Not reportedDEBIAN-CVE-2025-50343Not reported
Debianlibmatiodeb141.5.30-2Not reportedDEBIAN-CVE-2025-50343Not reported
Opensusematiorpmtumbleweed1.5.30-1.1Not reportedOPENSUSE-SU-2026:10094-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libmatio11]Affected

    Source package: [libmatio]

    Details (4)

    • 1.5.23-2+deb12u1 · amd64 · bookworm

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · arm64 · bookworm

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · amd64 · bookworm-security

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · arm64 · bookworm-security

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

  • [libmatio-dev]Affected

    Source package: [libmatio]

    Details (4)

    • 1.5.23-2+deb12u1 · amd64 · bookworm

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · arm64 · bookworm

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · amd64 · bookworm-security

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · arm64 · bookworm-security

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

  • [libmatio-doc]Affected

    Source package: [libmatio]

    Details (4)

    • 1.5.23-2+deb12u1 · all · bookworm

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · all · bookworm

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · all · bookworm-security

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · all · bookworm-security

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

  • [matio-tools]Affected

    Source package: [libmatio]

    Details (4)

    • 1.5.23-2+deb12u1 · amd64 · bookworm

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · arm64 · bookworm

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · amd64 · bookworm-security

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

    • 1.5.23-2+deb12u1 · arm64 · bookworm-security

      Affected · Fixed: 1.5.23-2+deb12u1

      dsa · libmatio · debian · bookworm; dsa · libmatio · debian · 12

[Debian 13 (Trixie)]

  • [libmatio13]Affected

    Source package: [libmatio]

    Details (2)

    • 1.5.28-2 · amd64 · trixie

      Affected

      dsa · libmatio · debian · 13

    • 1.5.28-2 · arm64 · trixie

      Affected

      dsa · libmatio · debian · 13

  • [libmatio-dev]Affected

    Source package: [libmatio]

    Details (2)

    • 1.5.28-2 · amd64 · trixie

      Affected

      dsa · libmatio · debian · 13

    • 1.5.28-2 · arm64 · trixie

      Affected

      dsa · libmatio · debian · 13

  • [libmatio-doc]Affected

    Source package: [libmatio]

    Details (2)

    • 1.5.28-2 · all · trixie

      Affected

      dsa · libmatio · debian · 13

    • 1.5.28-2 · all · trixie

      Affected

      dsa · libmatio · debian · 13

  • [matio-tools]Affected

    Source package: [libmatio]

    Details (2)

    • 1.5.28-2 · amd64 · trixie

      Affected

      dsa · libmatio · debian · 13

    • 1.5.28-2 · arm64 · trixie

      Affected

      dsa · libmatio · debian · 13

[openSUSE Tumbleweed]

  • [libmatio14]Unknown

    Source package: [matio]

    Details (1)

    • 1.5.30-1.5 · x86_64 · tumbleweed

      Unknown · Fixed: 1.5.30-1.1

      Version impact unknown

      dsa · matio · opensuse · tumbleweed

  • [libmatio-devel]Unknown

    Source package: [matio]

    Details (1)

    • 1.5.30-1.5 · x86_64 · tumbleweed

      Unknown · Fixed: 1.5.30-1.1

      Version impact unknown

      dsa · matio · opensuse · tumbleweed

  • [matio-tools]Unknown

    Source package: [matio]

    Details (1)

    • 1.5.30-1.5 · x86_64 · tumbleweed

      Unknown · Fixed: 1.5.30-1.1

      Version impact unknown

      dsa · matio · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]