CVE-2025-68794: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-3c24-c79w-qw24
Share
CVSS 9.8
CWE-190
Published
Advisory Summary

CVE-2025-68794 is a CRITICAL (CVSS 9.8) security vulnerability vulnerability (CWE-190: Integer Overflow or Wraparound) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. this occurs when an integer value is incremented to a value that is too large to store in the associated representation. when this occurs, the value may become a very small or negative number.. Remediation is available in the latest vendor maintenance releases.

CVE-2025-68794 at a Glance

CVE Identifier CVE-2025-68794
GHSA Identifier GHSA-3c24-c79w-qw24
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification CWE-190: Integer Overflow or Wraparound
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2025-68794

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2025-68794, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-190: Integer Overflow or Wraparound, where the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. this occurs when an integer value is incremented to a value that is too large to store in the associated representation. when this occurs, the value may become a very small or negative number. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: iomap: adjust read range correctly for non-block-aligned positions iomap_adjust_read_range() assumes that the position and length passed in are block-aligned. This is not always the case however, as shown in the syzbot generated case for erofs. This causes too many bytes to be skipped for uptodate blocks, which results in returning the incorrect position and length to read in. If all the blocks are uptodate, this underflows length and returns a position beyond the folio. Fix the calculation to also take into account the block offset when calculating how many bytes can be skipped for uptodate blocks.

References

NVD — CVE-2025-68794 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-68794
git.kernel.org/stable/c/12053695c8... WEB
https://git.kernel.org/stable/c/12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3e
git.kernel.org/stable/c/142194fb21... WEB
https://git.kernel.org/stable/c/142194fb21afe964d2d194cab1fc357cbf87e899
git.kernel.org/stable/c/275b37a1e5... WEB
https://git.kernel.org/stable/c/275b37a1e5c2c8abd313e8075f6aec9a349f291b
git.kernel.org/stable/c/7aa6bc3e87... WEB
https://git.kernel.org/stable/c/7aa6bc3e8766990824f66ca76c19596ce10daf3e
git.kernel.org/stable/c/82b60ffbb5... WEB
https://git.kernel.org/stable/c/82b60ffbb532d919959702768dca04c3c0500ae5
git.kernel.org/stable/c/b8c9f25fd8... WEB
https://git.kernel.org/stable/c/b8c9f25fd84328c5fcc4f70c6d1e8f1d4787eaac
git.kernel.org/stable/c/ce20f49ac9... WEB
https://git.kernel.org/stable/c/ce20f49ac9194cf81a77f01d1c316d7c17ae753c

Frequently Asked Questions

What is CVE-2025-68794?
CVE-2025-68794 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-190: Integer Overflow or Wraparound.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2025-68794?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2025-68794?
CVE-2025-68794 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2025-68794?
CVE-2025-68794 is classified under CWE-190: Integer Overflow or Wraparound (The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.).
How can I check Maven dependencies for CVE-2025-68794?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3c24-c79w-qw24",
  "modified" : "2026-08-27T15:30:29Z",
  "published" : "2026-01-13T18:31:04Z",
  "aliases" : [ "CVE-2025-68794" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: adjust read range correctly for non-block-aligned positions\n\niomap_adjust_read_range() assumes that the position and length passed in\nare block-aligned. This is not always the case however, as shown in the\nsyzbot generated case for erofs. This causes too many bytes to be\nskipped for uptodate blocks, which results in returning the incorrect\nposition and length to read in. If all the blocks are uptodate, this\nunderflows length and returns a position beyond the folio.\n\nFix the calculation to also take into account the block offset when\ncalculating how many bytes can be skipped for uptodate blocks.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-68794"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/12053695c8ef5410e8cc6c9ed4c0db9cd9c82b3e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/142194fb21afe964d2d194cab1fc357cbf87e899"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/275b37a1e5c2c8abd313e8075f6aec9a349f291b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7aa6bc3e8766990824f66ca76c19596ce10daf3e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/82b60ffbb532d919959702768dca04c3c0500ae5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b8c9f25fd84328c5fcc4f70c6d1e8f1d4787eaac"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ce20f49ac9194cf81a77f01d1c316d7c17ae753c"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-190" ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-01-13T16:16:01Z"
  }
}