Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• mumble mumbleup to 1.2.3 inclusive
• mumble mumble1.2.0
• mumble mumble1.2.2

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2021-27229Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text
  36Monitor
• CVE-2020-13962Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause
  31Monitor
• CVE-2018-20743murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows r
  31Monitor
• CVE-2010-2490Mumble: murmur-server has DoS due to malformed client query
  26Monitor
• CVE-2025-71264Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).
  21Monitor
• CVE-2014-3755The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resou
  21Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.