Security readout for executives and security teams
Plain-English summary
CVE-2025-46171 is a resource-exhaustion issue in vBulletin 3.8.7. A forum can crash if a user with a very large buddy list causes the buddylist page to consume excessive memory. The business impact is service disruption, especially for public forums still running this legacy version.
Executive priority
Treat this as a moderate operational risk for legacy forum assets. Prioritize internet-facing vBulletin 3.8.7 systems because a crash can disrupt customer or community access, but current sources do not support emergency KEV-level urgency.
Technical view
The source describes CWE-400 resource consumption in misc.php?do=buddylist. Processing an authenticated user’s large buddy list may exhaust memory and crash the forum. The record lists CVSS 5.4, but its vector does not fully align with the stated availability-focused impact, so treat scoring details cautiously.
Likely exposure
Exposure is most likely on internet-facing vBulletin 3.8.7 forums where buddy lists are enabled and users can authenticate. The source bundle does not provide populated CPEs, broader affected ranges, or vendor-confirmed product metadata.
Exploitation context
The bundle does not cite CISA KEV and provides no evidence of active exploitation. A public GitHub reference exists, but this assessment should not infer weaponized exploitation or widespread scanning from that alone.
Researcher notes
Evidence is limited to the CVE description and a public GitHub reference. The affected array is not populated, and the CVSS vector appears inconsistent with the described authenticated availability impact. Validate against real deployments before expanding scope.
Mitigation direction
- Check official vBulletin guidance for supported upgrades or advisory-specific workarounds.
- Identify and prioritize any remaining vBulletin 3.8.7 deployments.
- Apply rate limits and monitoring to authenticated requests hitting the buddylist endpoint.
- Consider disabling or constraining buddy list functionality if supported by configuration.
- Review server memory limits and crash recovery for affected forums.
Validation and detection
- Inventory forum software versions and confirm whether vBulletin 3.8.7 is present.
- Check whether misc.php?do=buddylist is reachable on exposed forums.
- Review logs for repeated buddylist requests and memory exhaustion events.
- Verify whether unusually large buddy lists exist for active accounts.
- Track vendor or project guidance because no patch is named in the bundle.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-46171 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N2.82.5CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/oiyl/CVE-2025-46171CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.