CVE-2025-47256: Libxmp

Medium severity, CVSS 5.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Affected products

• Libxmp Libxmp: up to and including 4.6.2

Published 2025-05-06. Last modified 2026-06-17.