CVE-2025-46171: vBulletin

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum.

Affected products

• vBulletin vBulletin: version 3.8.7 only

Published 2025-07-23. Last modified 2026-07-05.