libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

🔗 CVE IDs covered (1)

🎯 Affected products4

• azl3 libsodium 1.0.19-1 on Azure Linux 3.0
• azl3 libsodium 1.0.19-2 on Azure Linux 3.0
• cbl2 libsodium 1.0.18-6 on CBL Mariner 2.0
• cbl2 libsodium 1.0.18-7 on CBL Mariner 2.0

✅ Remediation

KBCBL-Mariner Releases (Security Update) — fixed build 1.0.19-2 KBCBL-Mariner Releases (Security Update) — fixed build 1.0.18-7

🔗 References (2)

• advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-69277
• referencehttps://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade