Crypto Foundation Cracked: One-Byte Overflow in GNU libtasn1 (CVE-2025-13151)

Crypto Foundation Cracked: One-Byte Overflow in GNU libtasn1 (CVE-2025-13151) reports a stack-based buffer overflow in GNU libtasn1, a critical library used for parsing ASN.1 data in secure communications. The flaw, tracked as CVE-2025-13151 with a CVSS score of 7.5, lies in the asn1_expand_octet_string function and can lead to memory corruption in security-sensitive contexts.

The issue stems from unsafe string concatenation using unbounded functions (strcpy and strcat) to join two names with a separator, resulting in a destination buffer undersized by one byte when the inputs are at maximum length. Consequently, the final null terminator can overflow the allocated stack buffer by a single byte, with potential effects on cryptographic operations such as signature verification or certificate parsing.

The vulnerability was disclosed by Benny Zelster from Microsoft Research, and a patch has been proposed to fix the unsafe handling, alongside mitigations such as bounded string operations. Developers are urged to evaluate the patch and apply mitigations to secure applications relying on libtasn1.