Read the docs
TI-2025-43388 Aliases CVE-2025-71264GHSA-r4p8-phpj-5pvw

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Priority LOW 24CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00293 22nd percentileScored 2026-11-07
Fix Fixed Mumble (Mumble): 1.6.870

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MumbleMumblebefore 1.6.8701.6.870Patch availableCNA
  • Mumble VendorMumble Affected before 1.6.870 Fixed in 1.6.870 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mumble:mumble:*:*:*:*:*:*:*:*before 1.6.870VulnerableMumble
  • cpe:2.3:a:mumble:mumble:*:*:*:*:*:*:*:* Versions before 1.6.870 Vulnerable ·Mumble

Remediation

  • Fix · CNA Mumble (Mumble) Fixed in 1.6.870

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-71264
  2. 2026-10-03 Alias added: GHSA-r4p8-phpj-5pvw

References

Patch 2

Other 1

  • TI-2021-08770 Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL… CVSS 3.1HIGH 8.8
  • TI-2018-14720 murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests… CVSS 3.0HIGH 7.5
  • TI-2020-10938 Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other… CVSS 3.1HIGH 7.5
  • TI-2010-02390 Mumble: murmur-server has DoS due to malformed client query CVSS 3.1MEDIUM 6.5
  • TI-2014-03048 The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote… CVSS 2.0MEDIUM 5.0
  • TI-2014-03049 The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of… CVSS 2.0MEDIUM 5.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences