CVE-2025-47256: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-47256 is a stack-based buffer overflow vulnerability discovered in Libxmp through version 4.6.2. The vulnerability exists in the depack_pha function within loaders/prowizard/pha.c and is triggered when processing malformed Pha format tracker modules in .mod files. The issue was discovered and reported on May 5, 2025 (NVD, GitHub Issue).

The vulnerability occurs in the depack_pha() function due to improper bounds checking on a local stack buffer during pattern parsing. It has been assigned a CVSS v3.1 base score of 5.6 (Medium) with the vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L. The weakness has been classified as CWE-191 (Integer Underflow) (NVD, Wiz).

The vulnerability can lead to denial-of-service (DoS) conditions and potentially remote code execution (RCE) under specific build or runtime conditions. The impact is considered medium severity due to the local access requirement and high complexity of exploitation (GitHub Issue, Wiz).

A fix has been implemented in version 4.6.2-2 for Debian sid. Other distributions including Debian bullseye, bookworm, and trixie remain vulnerable with versions 4.4.1-3, 4.5.0-2, and 4.6.2-1 respectively (Debian Tracker).