CVE-2025-6536 in Tarantool
Summary
by MITRE • 06/24/2025
A vulnerability has been found in Tarantool up to 3.3.1 and classified as problematic. Affected by this vulnerability is the function tm_to_datetime in the library src/lib/core/datetime.c. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/27/2025
The vulnerability identified as CVE-2025-6536 represents a critical assertion failure within the Tarantool database system version 3.3.1 and earlier. This issue resides in the tm_to_datetime function located in the source file src/lib/core/datetime.c, which forms part of Tarantool's core datetime processing library. The vulnerability manifests when specific input parameters are processed through this function, leading to an assertion that can be reached by an attacker. The assertion failure occurs during the conversion of time structures to datetime representations, indicating a fundamental flaw in input validation and error handling mechanisms. This type of vulnerability is particularly concerning as it can potentially lead to system instability or denial of service conditions.
The technical exploitation of CVE-2025-6536 requires local access to the system, which limits its scope compared to remotely exploitable vulnerabilities. However, the fact that the exploit has been publicly disclosed significantly increases the risk profile for affected systems. The vulnerability falls under the category of assertion failure, which is classified as CWE-617 in the Common Weakness Enumeration system. This weakness represents a condition where an assertion statement in the code fails, potentially leading to program termination or unexpected behavior. The assertion failure in this context suggests that the tm_to_datetime function does not properly validate the input parameters or handle edge cases, allowing an attacker with local privileges to trigger the assertion through carefully crafted inputs.
From an operational impact perspective, this vulnerability creates significant risks for systems running affected versions of Tarantool. The assertion failure can result in application crashes or service interruptions, potentially leading to data availability issues for applications dependent on the database. Organizations using Tarantool for critical workloads may experience service degradation or complete system outages if this vulnerability is exploited. The local requirement for exploitation means that the attack vector is limited to individuals with access to the system, but this still represents a serious security concern, particularly in environments where local access is not properly controlled or where privilege escalation is possible. The vulnerability can be leveraged for denial of service attacks, potentially disrupting database operations and affecting business continuity.
The recommended mitigation strategy for CVE-2025-6536 involves immediate deployment of patches or updates to Tarantool versions that address this specific assertion failure. System administrators should prioritize updating to versions of Tarantool that have been verified to contain fixes for this vulnerability, as the public disclosure increases the likelihood of exploitation. Additionally, implementing proper access controls and privilege management can help mitigate the risk of local exploitation. Organizations should also consider monitoring for suspicious activities that might indicate attempted exploitation of this vulnerability. The ATT&CK framework categorizes this vulnerability under the T1499 sub-technique for network denial of service, as the assertion failure can potentially lead to service disruption. Regular security assessments and vulnerability scanning should be conducted to ensure that all systems running Tarantool are protected against this and similar vulnerabilities.