CVE-2025-50343: 
NixOS vulnerability analysis and mitigation

CVE-2025-50343 is a heap-based memory corruption vulnerability in the matio library version 1.5.28, specifically in the Mat_VarCreateStruct() function. When the nfields parameter does not match the actual number of strings in the fields array, the function performs out-of-bounds reads and invalid memory frees during cleanup, potentially causing a segmentation fault or heap corruption. The vulnerability was disclosed on December 30, 2025, and affects matio 1.5.28 (including the master branch at commit de6590eef17a19fc64c362af34294fbc58d2bd07). It carries a CVSS v3.1 base score of 9.8 (Critical) (Feedly, GitHub Issue).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow). The Mat_VarCreateStruct() function in matvar_struct.c accepts a fields array and an nfields count but performs no validation to ensure the array actually contains nfields valid (non-NULL) pointers. When nfields exceeds the actual number of entries in fields, the loop at line 83 iterates beyond valid memory, accessing uninitialized or out-of-bounds pointers. During cleanup, Mat_VarFree() then attempts to free() these corrupted fieldnames[i] entries, triggering undefined behavior. A public PoC demonstrates the issue by passing a single-element fields array with nfields set to 16, reliably triggering an AddressSanitizer SEGV signal (GitHub Issue, PoC).

Successful exploitation results in at minimum a denial of service via segmentation fault or process crash. In more severe scenarios, the heap corruption can be leveraged for arbitrary code execution, potentially compromising confidentiality, integrity, and availability of the affected system. If matio is embedded in a network-accessible service that processes user-supplied .mat files or constructs struct variables from user input, the vulnerability can be triggered remotely without authentication or user interaction (GitHub Issue, Feedly).

Public proof-of-concept code is available both as a GitHub issue report and a dedicated PoC repository, demonstrating reliable triggering of the vulnerability with AddressSanitizer (GitHub Issue, PoC). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.018% (0.000180), indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus plugin 297142 has been released to detect this vulnerability (Tenable).

1. Identify target: Locate applications or services that use matio 1.5.28 and accept user-controlled input for .mat file parsing or struct variable construction (e.g., scientific computing services, MATLAB file processors).
2. Craft malicious input: Prepare a call or input that triggers Mat_VarCreateStruct() with a mismatched nfields value — specifically, pass a fields array containing fewer entries than the declared nfields count (e.g., 1 actual field pointer but nfields = 16).
3. Trigger the vulnerability: Supply the crafted input to the target application. The function iterates up to nfields times over the undersized fields array, reading out-of-bounds memory.
4. Induce heap corruption: When Mat_VarFree() is subsequently called during cleanup, it attempts to free() the corrupted fieldnames[i] pointers, causing an invalid free and heap corruption or segmentation fault.
5. Achieve impact: At minimum, crash the target process (DoS). In exploitable heap layouts, leverage the invalid free for heap exploitation primitives to achieve arbitrary code execution (GitHub Issue, PoC).

• Process: Unexpected crashes or segmentation faults in processes using the matio library; abnormal termination of applications processing .mat files.
• Logs: Application logs showing SIGSEGV or SIGABRT signals originating from Mat_VarFree() or Mat_VarCreateStruct() in matvar_struct.c or mat.c; AddressSanitizer output referencing __asan::Allocator::Deallocate in the call stack.
• File System: Presence of core dump files generated by matio-linked processes; unexpected crash report files from scientific computing applications.
• Network: Unusual or malformed .mat file uploads to services that process MATLAB data files, particularly files with struct variables containing mismatched field counts (GitHub Issue).

The matio project released version 1.5.30 in January 2026, which addresses this and related vulnerabilities (SourceForge). Debian has issued a security update (DLA-4459-1) for the libmatio package (Debian LTS). Users should upgrade to matio 1.5.30 or later immediately. As a temporary workaround, restrict network access to services that process user-supplied .mat files, implement input validation at application boundaries to reject malformed struct field arrays, and increase monitoring for process crashes or segmentation faults on affected systems.

The vulnerability was reported by researcher zakkanijia via a GitHub issue on May 15, 2025, with a detailed PoC and root cause analysis (GitHub Issue). The issue was featured in a PoC weekly digest in January 2026 (PoC Week). Debian's LTS security team responded with an advisory and package update, and INCIBE (Spain's national cybersecurity agency) published an early warning alert for the vulnerability.