CVE-2025-6375 - poco MultipartReader.cpp MultipartInputStream null pointer dereference

Back Back to CVE browser

MEDIUM

poco MultipartReader.cpp MultipartInputStream null pointer dereference

Published Jun 21, 2025

4.8

MEDIUM

CVSS 4.0

EPSS 0.25%

Description

A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component.

Affected products

Vendor n/a Product Poco Default
n/a
- Version
  1.14.0
  Status
  affected
  Constraints
  -
- Version
  1.14.1
  Status
  affected
  Constraints
  -
- Version
  1.14.2
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Poco

n/a

Version	Status	Constraints
1.14.0	affected	-
1.14.1	affected	-
1.14.2	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-404

Improper Resource Shutdown or Release

CWE-476

NULL Pointer Dereference

References (8)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18796
Advisory
https://github.com/pocoproject/poco/commit/6f2f85913c191ab9ddfb8fae781f5d66afccf3bf
exploitpatch
https://github.com/pocoproject/poco/issues/4915
exploitissue-trackingIssue TrackingPatch
https://github.com/pocoproject/poco/releases/tag/poco-1.14.2-release
exploitpatchRelease Notes
https://github.com/user-attachments/files/19524599/poco_crash.txt
exploit
https://vuldb.com/?ctiid.313370
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.313370
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.597446
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18796		Advisory
https://github.com/pocoproject/poco/commit/6f2f85913c191ab9ddfb8fae781f5d66afccf3bf		exploitpatch
https://github.com/pocoproject/poco/issues/4915		exploitissue-trackingIssue TrackingPatch
https://github.com/pocoproject/poco/releases/tag/poco-1.14.2-release		exploitpatchRelease Notes
https://github.com/user-attachments/files/19524599/poco_crash.txt		exploit
https://vuldb.com/?ctiid.313370		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.313370		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.597446		third-party-advisoryThird Party AdvisoryVDB Entry