Heap Buffer Overflow Vulnerability in UPX Package
Summary
OSV-2025-544: Heap-buffer-overflow in N_BELE_RTP::LEPolicy::get32. Affects upx versions >= 24b4ec42e701814b5bf55685f6fbc81e25f1044c, < b52d3e077205022036ee1e1eeae41529c2cb57a2. Fixed in b52d3e077205022036ee1e1eeae41529c2cb57a2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UPX (Ultimate Packer for eXecutables) is a popular open-source executable packer that compresses executable files to reduce their size while maintaining their functionality. It is widely used in various software applications to optimize storage and distribution. However, UPX has been found to have a vulnerability that can lead to a heap buffer overflow, potentially allowing attackers to exploit the affected software.
Vulnerability Detail
The vulnerability identified in UPX is a heap buffer overflow that occurs in the function N_BELE_RTP::LEPolicy::get32. This issue can lead to unauthorized access to memory, which may allow an attacker to execute arbitrary code or crash the application. The vulnerability was reported through OSS-Fuzz, indicating that it can be triggered under specific conditions when processing certain ELF files.
How To Fix
Minimum fixed version
b52d3e077205022036ee1e1eeae41529c2cb57a2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted ELF files with UPX until the package is updated to the patched version. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The heap buffer overflow vulnerability in UPX poses a significant risk to applications that utilize this package. It is crucial to update to the patched version to mitigate potential exploitation. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for upx →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior.
If your application uses UPX and processes malicious ELF files, it may be susceptible to exploitation, allowing attackers to execute arbitrary code or crash the application.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If you cannot update UPX right away, ensure that your application does not process untrusted ELF files to minimize the risk of exploitation.
More information can be found in the OSS-Fuzz report linked in the vulnerability details, which provides insights into the crash type and state.
References
Related vulnerabilities
Recent vulnerabilities recorded for upx.
