CVE-2012-4025: Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows r

Q: How do I fix CVE-2012-4025?

squashfs: upgrade to newer than 4.2. Exact commands for each OS are on this page.

Q: Is CVE-2012-4025 being exploited?

CVE-2012-4025 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2012-4025 affect?

CVE-2012-4025 affects squashfs. Severity is medium (CVSS 6.8). Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based

Q: How urgent is CVE-2012-4025?

Priority 46/100. EPSS top 10%: very likely to be exploited

This month

MEDIUM 6.8UPGRADE

CVE-2012-4025 is a medium-severity flaw (CVSS 6.8) affecting squashfs. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.

Why this priority

EPSS top 10%: very likely to be exploited

A fixed release or distro patch exists.

Risk facts

CVSS score	6.8 (Medium)
EPSS exploit chance	3.9% (top 10%)
CISA exploited list	No
Weakness	CWE-190
Published	2012-07-19
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: squashfs project

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2012-07-19 19:55 UTCPublished CVE record published
2026-06-16 23:44 UTCUpdated Record last modified

squashfs project squashfs UPGRADE

Affected: <= 4.2

Fixed in: newer than 4.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy squashfs || rpm -q squashfs || squashfs --version

2. UPGRADE to newer than 4.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade squashfs

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade squashfs

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2012-4025?

squashfs: upgrade to newer than 4.2. Exact commands for each OS are on this page.

Is CVE-2012-4025 being exploited?

CVE-2012-4025 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2012-4025 affect?

CVE-2012-4025 affects squashfs. Severity is medium (CVSS 6.8). Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based

How urgent is CVE-2012-4025?

Priority 46/100. EPSS top 10%: very likely to be exploited

Related CVEs

CVE-2015-4646 HIGH 7.5 UPGRADE (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow rem
CVE-2015-4645 MEDIUM 5.5 UPGRADE MITIGATE Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote
CVE-2012-4024 MEDIUM 6.8 UPGRADE Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and ea

References

← Back to latest CVEs