CVE-2025-13425: 
vulnerability analysis and mitigation

CVE-2025-13425 is a NULL Pointer Dereference (CWE-476) vulnerability in Google's OSV-SCALIBR open-source software composition analysis library. A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, triggering a Go panic (index out of range) and application crash. All versions prior to 0.3.4 of the github.com/google/osv-scalibr Go module are affected. The vulnerability was published on November 20, 2025, with a CVSS v4 base score of 1.9 (Low) (Github Advisory).

The root cause is an out-of-bounds slice indexing bug (CWE-476) in the directory iterator's fallback path, triggered when a custom fs.FS implementation does not support the fs.ReadDirFile interface and returns nil from ReadDir to indicate an empty directory. The Next() function in fs/diriterate/diriterate.go previously checked i.files != nil to determine whether to use the pre-loaded file slice, but a nil slice from an empty directory was indistinguishable from the absence of the fs.ReadDirFile interface, causing the code to attempt indexing into a zero-length slice and panic. The fix changes the condition to len(i.files) > 0 and adds an explicit nil check on i.dir to return io.EOF immediately for empty directories (Github Commit, Github Advisory). Exploitation requires local access with low privileges and no user interaction.

Successful exploitation causes the OSV-SCALIBR application to panic and crash, resulting in a denial of service (DoS) condition that renders the scanner unresponsive. There is no impact on confidentiality or integrity — the vulnerability is limited to availability of the vulnerable system and, to a lesser extent, subsequent systems that depend on its output. Because OSV-SCALIBR is a security scanning tool, its unavailability could indirectly delay vulnerability detection in software supply chain workflows (Github Advisory).

A proof-of-concept exploit is publicly available on GitHub at https://github.com/0xXA/google-poc, added to tracking on March 2, 2026 (Feedly). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.005% (4th percentile), indicating a very low probability of exploitation in the near term (Github Advisory).

1. Identify target: Locate a system running OSV-SCALIBR versions prior to 0.3.4 with local access available.
2. Craft a custom FS implementation: Create or provide a custom fs.FS implementation that does not implement the fs.ReadDirFile interface and returns nil (rather than an empty slice) from its ReadDir-equivalent method when encountering an empty directory.
3. Trigger directory traversal: Invoke OSV-SCALIBR's scanning functionality against a filesystem path that includes an empty directory handled by the custom FS, causing diriterate.go:Next() to be called.
4. Trigger panic: The Next() function attempts to index into the nil/empty i.files slice without proper bounds checking, triggering a Go runtime panic with "index out of range."
5. Achieve DoS: The application crashes and becomes unresponsive, completing the denial of service (Github Commit, Github Advisory).

• Logs: Go runtime panic messages containing runtime error: index out of range in application logs, specifically referencing fs/diriterate/diriterate.go in the stack trace.
• Process: Unexpected termination of the osv-scalibr process; crash dumps or core files generated by the Go runtime in the working directory.
• File System: Presence of Go panic output files or unexpected process exit logs associated with the OSV-SCALIBR binary.

Upgrade OSV-SCALIBR to version 0.3.4 or later, which contains the fix addressing the out-of-bounds indexing issue in fs/diriterate/diriterate.go (Github Advisory, Github Commit). As a temporary workaround where upgrading is not immediately feasible, restrict local access to systems running vulnerable versions and apply the principle of least privilege to limit which accounts can interact with the application's directory traversal functionality. No configuration-only workaround is available; patching is the definitive remediation.