Vulnerability · Published Apr 28, 2025 · Assigned by VulDB

CVE-2025-4003RefindPlusRepo RefindPlus RP_ApfsIo.c InternalApfsTranslateBlock null pointer dereference

Medium 5.5

In plain English

A medium-severity null pointer dereference in RefindPlus from RefindPlusRepo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.2%top 90.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in RefindPlusRepo RefindPlus 0.14.2.AB. It has been classified as problematic. This affects the function InternalApfsTranslateBlock of the file Library/RP_ApfsLib/RP_ApfsIo.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The patch is named 4d35125ca689a255647e9033dd60c257d26df7cb. It is recommended to apply a patch to fix this issue.

Affected products (as reported)

Vendor	Product	Versions
RefindPlusRepo	RefindPlus	0.14.2.AB

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

VDB-306339 | RefindPlusRepo RefindPlus RP_ApfsIo.c InternalApfsTranslateBlock null pointer dereference vdb-entry, technical-description
VDB-306339 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #558123 | RefindPlusRepo RefindPlus v0.14.2.AB Release NULL Pointer Dereference third-party-advisory
https://github.com/RefindPlusRepo/RefindPlus/issues/206 issue-tracking
https://github.com/RefindPlusRepo/RefindPlus/issues/206#event-16595888967 issue-tracking
https://github.com/RefindPlusRepo/RefindPlus/commit/4d35125ca689a255647e9033dd60c257d26df7cb patch