HTACG tidy-html5 alloc.c defaultAlloc memory leak

published 2025-06-23 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-18861

cvss: 3.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits: 0; none known

A vulnerability classified as problematic has been found in HTACG tidy-html5 5.8.0. Affected is the function defaultAlloc of the file src/alloc.c. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 16 mo ago (2025-06-23)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/htacg/tidy-html5/issues/1152 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/user-attachments/files/20438303/tidy-html5_crash_3.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	4.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
CNA	3.0	3.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
CNA	2.0	1.7	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR
CNA	4.0	1.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA	2.0	1.7	AV:L/AC:L/Au:S/C:N/I:N/A:P

Affected products

HTACG tidy-html5

Classification

Weakness

CWE-401 Missing Release of Memory after Effective Lifetime
CWE-404 Improper Resource Shutdown or Release

References

github.com /htacg/tidy-html5/issues/1152
issue-tracking, exploit
github.com /user-attachments/files/20438303/tidy-html5_crash_3.txt
exploit
vuldb.com /?id.313614
vdb-entry, technical-description, third-party-advisory
vuldb.com /?ctiid.313614
signature, permissions-required, vdb-entry
vuldb.com /?submit.601009
third-party-advisory, vdb-entry

Sources

CVE List CVE-2025-6498
NVD CVE-2025-6498

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary