A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::size_ready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leveraged to run arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer (i.e., it is not necessary to use a typical buffer-overflow exploitation technique that changes the flow of control).
Conclusion & alert: CVE-2019-6250 is rated High Exploit Risk (78.4/100): CVSS High severity, with high exploitation likelihood (EPSS 15.60%, 95th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-29 | 28.55% | 15.60% | -12.96% |
| 2 | 2026-05-24 | 29.07% | 28.55% | -0.52% |
| 3 | 2026-05-22 | — | 29.07% | — |
Full EPSS history (50 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 8.8 | 3.0 | HIGH |
|
2.8 | 5.9 | [email protected] |
| 9.0 | 2.0 | HIGH |
|
8.0 | 10.0 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
high | CVE-2019-6250: 1 source package rows (zeromq); 10 state rows across 10 repos (3.10-main, 3.11-main, 3.12-main, 3.17-main, 3.18-main, 3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 10, open 0. | https://security.alpinelinux.org/vuln/CVE-2019-6250 |
debian
|
not yet assigned | CVE-2019-6250 not yet assigned priority: Debian including 1 source packages (zeromq3), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2019-6250 |
gentoo
|
high | CVE-2019-6250: 1 GLSA(s) (201903-22), 1 atom(s) (net-libs/zeromq); latest impact high. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2019-6250 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2019-6250 |
suse
|
high | CVE-2019-6250 severity important: SUSE including 274 source package names (0.3.2-1.2:libzmq5-4.2.3-3.3.2, 0.6.41-13.9:libzmq5-4.2.3-3.3.2, …), 475 product×package rows across 196 product lines (Container containers/lmcache-vllm-openai, Container containers/open-webui, … (196 product lines)): Known Affected 231, Fixed 207, Known Not Affected 37. | https://www.suse.com/security/cve/CVE-2019-6250/ |
ubuntu
|
medium | CVE-2019-6250 medium priority: Ubuntu including 1 source packages (zeromq3), 5 status rows across 5 suites (bionic, cosmic, trusty, upstream, xenial): released 3, not-affected 2. | https://ubuntu.com/security/CVE-2019-6250 |
| URL | Tags |
|---|---|
| https://github.com/zeromq/libzmq/issues/3351 | Exploit Patch Third Party Advisory |
| https://github.com/zeromq/libzmq/releases/tag/v4.3.1 | Third Party Advisory |
| https://security.gentoo.org/glsa/201903-22 | Third Party Advisory |
| https://www.debian.org/security/2019/dsa-4368 | Third Party Advisory |