CVE-2025-46333
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedz2d is a pure Zig 2D graphics library. Versions of z2d after `0.5.1` and up to and including `0.6.0`, when writing from one surface to another using `z2d.compositor.StrideCompositor.run`, and higher-level operations when the anti-aliasing mode is set to `.default` (such as `Context.fill`, `Context.stroke`, `painter.fill`, and `painter.stroke`), the source surface can be completely out-of-bounds on the x-axis, but not on the y-axis, by way of a negative offset. This results in an overflow of the value controlling the length of the stride. In non-safe optimization modes (consumers compiling with `ReleaseFast` or `ReleaseSmall`), this could potentially lead to invalid memory accesses or corruption. This issue is patched in version `0.6.1`. Users on an untagged version after `v0.5.1` and before `v0.6.1` are advised to update to address the vulnerability. Those still on Zig `0.13.0` are recommended to downgrade to `v0.5.1`.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe z2d Zig graphics library versions 0.5.2 through 0.6.0 have an integer overflow vulnerability in stride calculations when copying surfaces with a negative x-axis offset. The stride length value overflows when the source surface is completely out-of-bounds on the x-axis, bypassing bounds checks. In ReleaseFast/ReleaseSmall build modes, this can lead to invalid memory accesses and potential corruption.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- High
- Privileges
- Low
- Authentication
- X
- User interaction
- P
- Scope
- X
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed z2d versionLocate the z2d dependency in your project's build configuration (build.zig, build.zig.zon, or zig.lock) and read the version stringAffected if The version listed is 0.5.2, 0.5.3, 0.5.4, 0.6.0, or any version between 0.5.2 and 0.6.0 inclusive
-
Verify build configuration references z2dSearch your build.zig or build.zig.zon for 'z2d' or '@import("z2d")' statements to confirm the library is linkedAffected if z2d is present as a dependency in your build configuration
-
Check application uses surface copy operationsSearch your source code for function calls that copy surfaces, such as surfaceCopy, blit, or similar graphics operations that accept source and destination surface parametersAffected if Your code performs surface copying operations using z2d functions
-
Identify if negative x-axis offsets are passedSearch for surface copy calls where the x-offset parameter could be negative, or review runtime behavior when surfaces are positioned left of the destination boundsAffected if Your code passes negative values for x-axis coordinates when copying surfaces, or handles surfaces that may be positioned left of the destination bounds
-
Confirm build uses ReleaseFast or ReleaseSmallReview your build command or CI configuration for -Drelease-fast=true, -Drelease-small=true, or equivalent release build flagsAffected if You compile z2d-based code with ReleaseFast or ReleaseSmall optimization modes (the integer overflow manifests in these release modes)
-
Review memory access patterns during surface operationsIf applicable, run your application with memory sanitizers or debug builds to observe if surface copy operations with negative offsets cause unexpected memory access patternsAffected if Surface copy operations with negative x offsets result in out-of-bounds memory accesses or crashes
Your environment is affected if z2d version 0.5.2 through 0.6.0 is installed AND your code performs surface copy operations that can receive negative x-axis offsets, especially when built with ReleaseFast or ReleaseSmall modes.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpdate to version 0.6.1 or later. If using Zig 0.13.0 and unable to upgrade, downgrade to v0.5.1 as a temporary workaround.
0.6.1
- Update the z2d dependency to version 0.6.1 or later
- If using Zig 0.13.0 and experiencing compatibility issues with 0.6.1, downgrade to version 0.5.1 as a temporary workaround until compatibility is resolved
- Rebuild the project to ensure the patched version is used
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,328.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-46333 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-46333 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data