CVE catalog

CVE-2025-71264

mumble: CVE-2025-71264

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 25, 2026

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmumblesid1.5.857-2fixed
Debianmumbleforky1.5.857-2fixed
Debianmumbletrixie1.5.735-5+deb13u1fixed
Debianmumblebookworm1.3.4-4vulnerable
Ubuntumumblepro1.2.8-2ubuntu1vulnerable
Ubuntumumblepro1.2.12-1ubuntu1vulnerable
Ubuntumumblepro1.2.12-1ubuntu1+esm1vulnerable
Ubuntumumble18.041.2.18-1vulnerable
Ubuntumumble18.041.2.19-1vulnerable
Ubuntumumble18.041.2.19-1build1vulnerable
Ubuntumumble18.041.2.19-1ubuntu1vulnerable
Ubuntumumble18.041.2.19-1ubuntu1.1vulnerable
Ubuntumumble20.041.3.0+dfsg-1vulnerable
Ubuntumumble20.041.3.0+dfsg-1build1vulnerable
Ubuntumumble20.041.3.0+dfsg-1ubuntu0.1vulnerable
Ubuntumumble22.041.3.4-1vulnerable
Ubuntumumble22.041.3.4-1ubuntu1vulnerable
Ubuntumumble24.041.3.4-4vulnerable
Ubuntumumble24.041.5.517-1ubuntu1vulnerable
Ubuntumumble24.041.5.517-1ubuntu2vulnerable
Ubuntumumble25.101.5.735-3vulnerable
Ubuntumumble25.101.5.735-4vulnerable
Ubuntumumble25.101.5.735-5vulnerable
Ubuntumumble25.101.5.735-6vulnerable
Ubuntumumble26.041.5.735-6vulnerable
Ubuntumumble26.041.5.735-6build1vulnerable
Ubuntumumble26.041.5.735-7vulnerable
Ubuntumumble26.041.5.735-8vulnerable
Opensusemumbleleap 16.01.5.857-bp160.1.1fixed
Opensusemumbletumbleweed1.5.857-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmumblesourcesid1.5.735-7not yet assignedNot reported[1129178]
Debianmumblesourceforky1.5.735-7not yet assignedNot reported[1129178]
Debianmumblesourcetrixie1.5.735-5+deb13u1not yet assignedNot reported[1129178]
Debianmumblesourcebookworm(unfixed)not yet assignedNot reported[1129178]
Opensusemumblerpmleap 16.01.5.857-bp160.1.1Not reportedOPENSUSE-SU-2026:20394-1Not reported
Opensusemumblerpmtumbleweed1.5.857-2.1Not reportedOPENSUSE-SU-2026:10388-1Not reported

[Debian bug #1129178]

Notes

[bookworm] mumble: Minor issue; will be fixed via point release

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [mumble]Affected

    Source package: [mumble]

    Details (2)

    • 1.3.4-4 · amd64 · bookworm

      Affected

      dsa · mumble · debian · bookworm; dsa · mumble · debian · 12

    • 1.3.4-4+b1 · arm64 · bookworm

      Affected

      dsa · mumble · debian · bookworm; dsa · mumble · debian · 12

  • [mumble-server]Affected

    Source package: [mumble]

    Details (2)

    • 1.3.4-4 · amd64 · bookworm

      Affected

      dsa · mumble · debian · bookworm; dsa · mumble · debian · 12

    • 1.3.4-4+b1 · arm64 · bookworm

      Affected

      dsa · mumble · debian · bookworm; dsa · mumble · debian · 12

[openSUSE Tumbleweed]

  • [mumble-server]Unknown

    Source package: [mumble]

    Details (1)

    • 1.5.915-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.5.857-2.1

      Version impact unknown

      dsa · mumble · opensuse · tumbleweed

  • [mumble]Fixed

    Source package: [mumble]

    Details (1)

    • 1.5.915-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.5.857-2.1

      dsa · mumble · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [mumble]Fixed
    Details (2)

    • 1.5.735-5+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.5.735-5+deb13u1

      dsa · mumble · debian · 13

    • 1.5.735-5+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.5.735-5+deb13u1

      dsa · mumble · debian · 13

  • [mumble-server]Fixed

    Source package: [mumble]

    Details (2)

    • 1.5.735-5+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.5.735-5+deb13u1

      dsa · mumble · debian · 13

    • 1.5.735-5+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.5.735-5+deb13u1

      dsa · mumble · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]