CVE-2025-48174: 
NixOS vulnerability analysis and mitigation

CVE-2025-48174 affects libavif versions before 1.3.0, where an integer overflow vulnerability exists in the makeRoom function within stream.c. The vulnerability was discovered and disclosed on May 16, 2025. The vulnerability has been assigned a CVSS v3.1 base score of 4.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L (NVD, Wiz).

The vulnerability stems from an integer overflow condition in the makeRoom function of stream.c, specifically in the calculation of stream->offset+size. When stream->offset or size is very large, the calculation may cause an integer overflow, resulting in an abnormally small neededSize. This can lead to an incorrect newSize and insufficient buffer allocation, which may subsequently cause a buffer overflow during the memcpy operation (GitHub PR).

When exploited, this vulnerability could lead to buffer overflow conditions due to insufficient memory allocation caused by the integer overflow. This could potentially result in limited impact on system integrity and availability (Wiz).

The vulnerability has been fixed in libavif version 1.3.0. The fix includes adding proper integer overflow checks to the makeRoom function to prevent the overflow condition. Users are advised to upgrade to version 1.3.0 or later (GitHub Commit).