CVE-2025-32439: Pleezer Remote Code Execution Vulnerability

MODERATE
Advisory Identifier: GHSA-472w-7w45-g3w5
Share
CVSS 6.5
CWE-772 CWE-460
Published
Advisory Summary

CVE-2025-32439 is a MODERATE (CVSS 6.5) remote code execution vulnerability (CWE-772: Missing Release of Resource after Effective Lifetime) affecting Pleezer libraries in the crates.io ecosystem. The issue involves pleezer resource exhaustion through uncollected hook script processes. Remediation is available by upgrading affected packages to version 0.16.0.

CVE-2025-32439 at a Glance

CVE Identifier CVE-2025-32439
GHSA Identifier GHSA-472w-7w45-g3w5
Severity MODERATE
CVSS v3.1 Base Score 6.5
CWE Classification CWE-772: Missing Release of Resource after Effective Lifetime
Affected Product Pleezer
Package Ecosystem crates.io
Published Date
Last Updated

Security Impact

CVSS: 6.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2025-32439

To remediate this vulnerability, upgrade all affected Pleezer dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

pleezer fixed: 0.16.0 
Upgrade pleezer to 0.16.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for pleezer

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-32439, inspect your project dependencies for Pleezer:

inspect dependencies for pleezer

Analyze the terminal output to locate any version of Pleezer in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.16.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-772: Missing Release of Resource after Effective Lifetime, where the product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed. In Pleezer, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In affected versions, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table. Even during normal usage, every track change and playback event would leave behind zombie processes. This leads to inevitable resource exhaustion over time as the system's process table fills up, eventually preventing new processes from being created. The issue is exacerbated if events occur rapidly, whether through normal use (e.g., skipping through a playlist) or potential manipulation of the Deezer Connect protocol traffic. This vulnerability affects all users who have configured hook scripts using the `--hook` option. ### Patches This issue has been fixed in version 0.16.0. Users should upgrade to this version, which properly manages child processes using asynchronous process handling and cleanup. ### Workarounds Users who cannot upgrade immediately can: - Disable hook scripts by removing the `--hook` option - Ensure hook scripts handle their own child process cleanup - Regularly restart pleezer to clear accumulated zombie processes ### References - Initial report: https://github.com/roderickvd/pleezer/discussions/83#discussioncomment-12818199 - Fix commit: 436a5f1e4c08989b58dbba2b0ffa423458016c2d - Fixed release: https://github.com/roderickvd/pleezer/releases/tag/v0.16.0

CVE-2025-32439 Affected Pleezer Versions

1 component(s)
Fixed Versions:
0.16.0
Product / Package Ecosystem Affected Versions Fixed Version
pleezer
 crates.io
< 0.16.0
0.16.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/roderickvd/pleezer/security/advisories/GHSA-472w-7w45-g3w5
NVD — CVE-2025-32439 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32439
Security Fix Commit FIX COMMIT
https://github.com/roderickvd/pleezer/commit/436a5f1e4c08989b58dbba2b0ffa423458016c2d
Pleezer Source Repository REPOSITORY
https://github.com/roderickvd/pleezer
Pleezer Source Repository REPOSITORY
https://github.com/roderickvd/pleezer/discussions/83#discussioncomment-12818199
Pleezer Release RELEASE
https://github.com/roderickvd/pleezer/releases/tag/v0.16.0

Frequently Asked Questions

What is CVE-2025-32439?
CVE-2025-32439 is a security vulnerability in Pleezer involving Pleezer resource exhaustion through uncollected hook script processes under CWE-772: Missing Release of Resource after Effective Lifetime.
Which Pleezer versions are affected?
Affected versions include releases prior to 0.16.0 across affected packages: pleezer.
What version fixes CVE-2025-32439?
Upgrading to 0.16.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is pleezer affected?
Yes, pleezer is affected in releases prior to 0.16.0. Upgrade your dependency to 0.16.0 or later.
What is the CVSS score of CVE-2025-32439?
CVE-2025-32439 has a CVSS v3.1 base score of 6.5 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2025-32439?
CVE-2025-32439 is classified under CWE-772: Missing Release of Resource after Effective Lifetime (The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.).
How can I check crates.io dependencies for CVE-2025-32439?
Run the dependency tree command: 'inspect dependencies for pleezer'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-472w-7w45-g3w5",
  "modified" : "2025-07-21T16:49:50Z",
  "published" : "2025-04-14T17:49:15Z",
  "aliases" : [ "CVE-2025-32439" ],
  "summary" : "Pleezer resource exhaustion through uncollected hook script processes",
  "details" : "### Impact\nHook scripts in pleezer can be triggered by various events like track changes and playback state changes. In affected versions, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table.\n\nEven during normal usage, every track change and playback event would leave behind zombie processes. This leads to inevitable resource exhaustion over time as the system's process table fills up, eventually preventing new processes from being created. The issue is exacerbated if events occur rapidly, whether through normal use (e.g., skipping through a playlist) or potential manipulation of the Deezer Connect protocol traffic.\n\nThis vulnerability affects all users who have configured hook scripts using the `--hook` option.\n\n### Patches\nThis issue has been fixed in version 0.16.0. Users should upgrade to this version, which properly manages child processes using asynchronous process handling and cleanup.\n\n### Workarounds\nUsers who cannot upgrade immediately can:\n- Disable hook scripts by removing the `--hook` option\n- Ensure hook scripts handle their own child process cleanup\n- Regularly restart pleezer to clear accumulated zombie processes\n\n### References\n- Initial report: https://github.com/roderickvd/pleezer/discussions/83#discussioncomment-12818199\n- Fix commit: 436a5f1e4c08989b58dbba2b0ffa423458016c2d\n- Fixed release: https://github.com/roderickvd/pleezer/releases/tag/v0.16.0",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "pleezer"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.16.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/roderickvd/pleezer/security/advisories/GHSA-472w-7w45-g3w5"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-32439"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/roderickvd/pleezer/commit/436a5f1e4c08989b58dbba2b0ffa423458016c2d"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/roderickvd/pleezer"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/roderickvd/pleezer/discussions/83#discussioncomment-12818199"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/roderickvd/pleezer/releases/tag/v0.16.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-460", "CWE-772" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-04-14T17:49:15Z",
    "nvd_published_at" : "2025-04-15T20:15:39Z"
  }
}