CVE-2025-4638 is a critical flaw (CVSS 9.8) in the copy of zlib bundled with the Point Cloud Library. It involves improper pointer arithmetic in inftrees.c. The record says it matters only for PCL before 1.14.0, or builds that turn off the system zlib. Use the system zlib or upgrade.
What's affected
The NVD record describes a flaw in the inftrees.c component of zlib as bundled inside PointCloudLibrary (PCL). Whether your build is affected depends on which zlib it uses.
According to the record, since PCL 1.14.0 the library uses the zlib installed on the system by default. The bundled copy is used only if the build sets WITH_SYSTEM_ZLIB=FALSE. So the issue applies in two cases: PCL older than 1.14.0, or a newer build that explicitly asks for the bundled zlib.
The record points to a pull request and a commit in the PCL repository that address the issue. It does not name a PCL release number as the fix, so read the pull request to see where it landed.
How to check if you're exposed
PCL is usually built from source or pulled in by robotics and mapping projects, so check both the version and the build flags.
- Check the PCL version your project links against. With CMake, look for the PCL version in your configure output, or run the command shown below where a pkg-config file exists.
- In your CMake cache, search for the WITH_SYSTEM_ZLIB setting with
grep WITH_SYSTEM_ZLIB CMakeCache.txt. - For Python bindings and container images, list installed packages and look for pcl, libpcl and zlib versions.
- Look in your SBOM for PCL and for a vendored zlib directory in the build tree.
The free in-browser dependency scan covers dependency manifests, but a bundled copy of C code can hide inside a source tree, so also check your build files.
Commands referred to above, in order:
pkg-config --modversion pcl_common
What to do now
- Find every project and image that builds or ships PCL and note the version.
- If you use PCL older than 1.14.0, upgrade to 1.14.0 or later so that the system zlib is used by default.
- If you set WITH_SYSTEM_ZLIB=FALSE, remove the setting or review the pull request linked in the record and apply the change to your tree.
- Update the operating system zlib package to the version your distribution recommends.
- Rebuild and redeploy the binaries, since the bundled code is compiled in and a package update alone does not change it.
- Add a build check that fails if a vendored zlib appears in the dependency tree.
Why it matters
The record lists CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Pointer arithmetic that moves beyond the memory it should address is undefined behaviour in C. Depending on the data, a program may crash, read the wrong memory or write to it.
The problem here is not in PCL's own algorithms but in a copy of a widely used compression library. Vendored libraries age silently: the original project fixes a bug, and each project with its own copy has to notice. That is why inventories of what is really inside a build matter. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
The demo shows how a dependency inventory surfaces components that sit inside your build, including ones you did not add on purpose.
Click through it at your own pace, or open it full screen.
Quick check
Do all PCL users need to act?
Only builds that use the bundled zlib: PCL older than 1.14.0, or newer builds with WITH_SYSTEM_ZLIB set to FALSE.
Which PCL release has the fix?
The record names no release. It links a pull request and a commit, which you should read to confirm.
Sources
Last reviewed: 18 October 2026.
