CVE-2025-15564: 
NixOS vulnerability analysis and mitigation

CVE-2025-15564 is a divide-by-zero vulnerability in Mapnik, an open-source C++ mapping toolkit, affecting versions up to and including 4.2.0. The flaw resides in the mapnik::detail::mod<...>::operator() function within src/value.cpp (line 389), where a modulo operation is performed without checking for a zero divisor. It was reported via a GitHub issue on December 19, 2025, and publicly disclosed on February 7, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 1.9 (Low) (Feedly, Mapnik Issue).

The root cause is classified as CWE-369 (Divide By Zero): the mapnik::detail::mod operator in src/value.cpp performs a raw integer modulo (%) on long values without validating that the divisor is non-zero. When Mapnik parses an XML map style file containing a malicious expression — such as a stroke-width attribute with a modulo expression where the divisor evaluates to zero — the expression evaluator triggers a SIGFPE (Floating Point Exception / hardware division-by-zero fault), immediately terminating the process. The attack vector is local, requiring low privileges and no user interaction; the attacker must be able to supply a crafted XML style file to the Mapnik parser. A public proof-of-concept reproducer file is available, consisting of a minimal XML snippet with a crafted stroke-width value (e.g., 8888%-00/8*888%88888882) that triggers the fault (Mapnik Issue, PoC Repro).

Successful exploitation causes the Mapnik process to crash with a SIGFPE signal, resulting in a denial-of-service (DoS) condition. The impact is limited to availability — there is no confidentiality or integrity impact, and no lateral movement or data exfiltration risk is associated with this vulnerability. Applications that load untrusted or user-supplied Mapnik XML style files are most at risk, as a single malformed file can bring down the rendering process (Feedly, Mapnik Issue).

A public proof-of-concept reproducer is available on GitHub and was disclosed alongside the bug report (PoC Repro). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been made. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Prepare a malicious XML style file: Craft a Mapnik XML map style file containing a symbolizer property (e.g., stroke-width) with a modulo expression where the divisor evaluates to zero, such as stroke-width="8888%-00/8*888%88888882". The public PoC file demonstrates this with the payload: <Rule><PolygonSymbolizer fill="#0000ff"/><LineSymbolizer stroke=" hf0000" stroke-width="8888%-00/8*888%88888882"/></Rule> (PoC Repro).
2. Deliver the file to the target: Place the malicious XML file in a location where the Mapnik-based application will load it — this could be a shared style directory, a user-configurable style path, or any input channel that accepts Mapnik XML styles.
3. Trigger parsing: Cause the target application to load and parse the malicious XML file (e.g., by invoking the map renderer or a harness such as ./harness_map_xml_simple repro).
4. Crash the process: The Mapnik expression evaluator processes the modulo operation, passes a zero divisor to mapnik::detail::mod::operator() at src/value.cpp:389, and the process terminates with SIGFPE, achieving denial of service (Mapnik Issue).

• Logs: Application crash logs or core dumps referencing SIGFPE or Floating Point Exception originating from mapnik::detail::mod::operator() in src/value.cpp:389; AddressSanitizer output with AddressSanitizer: FPE and stack frames including evaluate_expression and parse_stroke.
• File System: Presence of unexpected or externally supplied Mapnik XML style files containing modulo expressions (%) in symbolizer property values such as stroke-width; core dump files (core.*) in the working directory of the Mapnik process.
• Process: Unexpected termination of Mapnik rendering processes with exit signal 8 (SIGFPE); repeated process restarts by a supervisor or service manager for a Mapnik-based service.

As of the time of disclosure, the Mapnik project had not released a patch, though the issue was milestoned for version 4.2.2 on the GitHub tracker. Mapnik v4.2.2 has since been released (March 30, 2026) and users should upgrade to this version or later (Mapnik Repo). As interim mitigations: restrict local access to systems running Mapnik up to 4.2.0; validate and sanitize all XML style file inputs to reject expressions containing modulo operations with potentially zero divisors; and limit the privileges of processes running Mapnik to reduce the attack surface (Feedly).

The vulnerability was reported by researcher "oneafter" via a GitHub issue on December 19, 2025, with a detailed ASAN stack trace and a minimal reproducer. The Mapnik project acknowledged the issue by assigning it to milestone 4.2.2 but had not publicly responded with a fix at the time of CVE publication. Red Hat tracked the CVE but assessed it as low urgency. No significant broader media coverage or notable social media discussion has been observed for this vulnerability (Mapnik Issue, Red Hat CVE).