Vulnerability · Published Oct 19, 2025 · Assigned by mitre
CVE-2025-62672
Medium 5.3
In plain English
A medium-severity resource allocation without limits in rplay from boyns. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 53.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
rplay through 3.3.2 allows attackers to cause a denial of service (SIGSEGV and daemon crash) or possibly have unspecified other impact. This occurs in memcpy in the RPLAY_DATA case in rplay_unpack in librplay/rplay.c, potentially reachable via packet data with no authentication.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rplay | no fix listed | DEBIAN-CVE-2025-62672 |
| Debian:13 | rplay | no fix listed | DEBIAN-CVE-2025-62672 |
| Debian:14 | rplay | 3.3.2-22 | DEBIAN-CVE-2025-62672 |
| Ubuntu:22.04:LTS | rplay | no fix listed | UBUNTU-CVE-2025-62672 |
| Ubuntu:24.04:LTS | rplay | no fix listed | UBUNTU-CVE-2025-62672 |
| Ubuntu:25.10 | rplay | no fix listed | UBUNTU-CVE-2025-62672 |
| Ubuntu:26.04:LTS | rplay | no fix listed | UBUNTU-CVE-2025-62672 |
| Ubuntu:26.10 | rplay | no fix listed | UBUNTU-CVE-2025-62672 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L