CVE-2025-2900: 
IBM Semeru Runtime vulnerability analysis and mitigation

IBM Semeru Runtime versions 8.0.302.0 through 8.0.442.0, 11.0.12.0 through 11.0.26.0, 17.0.0.0 through 17.0.14.0, and 21.0.0.0 through 12.0.6.0 is affected by a denial of service vulnerability identified as CVE-2025-2900. The vulnerability was disclosed on May 14, 2025, and is caused by a buffer overflow in the native AES/CBC encryption implementation (IBM Security, NVD Database).

The vulnerability is classified as a Heap-based Buffer Overflow (CWE-122) that affects the native AES/CBC encryption implementation. It has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (IBM Security).

When exploited, the vulnerability can result in a denial of service condition through a buffer overflow that leads to a subsequent crash of the affected system. The CVSS scoring indicates high impact on availability while confidentiality and integrity remain unaffected (IBM Security).

The vulnerability is network-accessible and requires low attack complexity with no privileges or user interaction needed for exploitation, as indicated by the CVSS vector string. No public exploits have been reported at the time of disclosure (Wiz Security).

IBM has released fixed versions of the Semeru Runtime: 8.0.452.0, 11.0.27.0, 17.0.15.0, and 21.0.7.0. IBM customers requiring an update for an SDK shipped with an IBM product should contact IBM support and reference APAR number IJ54115 (IBM Security).