{"cve":"CVE-2025-23157","nvd":{"published":"2025-05-01T13:15:51.623","modified":"2026-07-30T06:22:17.673","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi_parser: add check to avoid out of bound access\n\nThere is a possibility that init_codecs is invoked multiple times during\nmanipulated payload from video firmware. In such case, if codecs_count\ncan get incremented to value more than MAX_CODEC_NUM, there can be OOB\naccess. Reset the count so that it always starts from beginning.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","score":7.1},"cwes":["CWE-125"],"references":["https://git.kernel.org/stable/c/172bf5a9ef70a399bb227809db78442dc01d9e48","https://git.kernel.org/stable/c/1ad6aa1464b8a5ce5c194458315021e8d216108e","https://git.kernel.org/stable/c/26bbedd06d85770581fda5d78e78539bb088fad1","https://git.kernel.org/stable/c/2b8b9ea4e26a501eb220ea189e42b4527e65bdfa","https://git.kernel.org/stable/c/53e376178ceacca3ef1795038b22fc9ef45ff1d3"],"products":["debian:debian_linux","linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:01:11.054312287+00:00"},"epss":{"cve":"CVE-2025-23157","score":0.00224,"percentile":0.13018,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}