What is CVE-2015-5237?

CVE-2015-5237 is a high-severity vulnerability in Google Protobuf, classified under Out-of-bounds Write. CVSS score: 8.8/10. Published 2017-09-25.

How severe is CVE-2015-5237?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2015-5237 known to be exploited?

9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Google Protobuf

CVE-2015-5237

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Vulnerability class: Buffer Overflow

Published 2017-09-25 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.050 (91.9th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 91.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.051 · newest: 0.050 · change: -0.001

Affected products

Google Protobuf

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

Public proof-of-concept exploits

References

github.com/google/protobuf/issues/760 (Third Party Advisory, Issue Tracking)
www.openwall.com/lists/oss-security/2015/08/27/2 (mailing-list, Mailing List, Third Party Advisory)
bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b… (mailing-list)
lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864… (mailing-list)
lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d79… (mailing-list)
lists.apache.org/thread.html/ra28fed69eef3a71e5fe5daea001d0456b05b102044237330e… (mailing-list)
lists.apache.org/thread.html/r17dc6f394429f6bffb5e4c66555d93c2e9923cbbdc5a93db9… (mailing-list)
lists.apache.org/thread.html/r42e47994734cd1980ef3e204a40555336e10cc80096927aca… (mailing-list)
lists.apache.org/thread.html/re6d04a214424a97ea59c62190d79316edf311a0a6346524df… (mailing-list)

Frequently asked questions

What is CVE-2015-5237?: CVE-2015-5237 is a high-severity vulnerability in Google Protobuf, classified under Out-of-bounds Write. CVSS score: 8.8/10. Published 2017-09-25.
How severe is CVE-2015-5237?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2015-5237 known to be exploited?: 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.