Log in Start free

Vulnerability · Published Aug 9, 2025 · Assigned by VulDB

CVE-2025-8746GNU libopts __strstr_sse2 memory corruption

Low 3.3

In plain English

A low-severity memory corruption in libopts from GNU. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 85.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, was found in GNU libopts up to 27.6. Affected is the function __strstr_sse2. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. This issue was initially reported to the tcpreplay project, but the code maintainer explains, that this "bug appears to be in libopts which is an external library." This vulnerability only affects products that are no longer supported by the maintainer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12autogenno fix listedDEBIAN-CVE-2025-8746
Debian:13autogenno fix listedDEBIAN-CVE-2025-8746
Debian:14autogen1:5.18.16-8DEBIAN-CVE-2025-8746
Ubuntu:22.04:LTSautogenno fix listedUBUNTU-CVE-2025-8746
Ubuntu:24.04:LTSautogenno fix listedUBUNTU-CVE-2025-8746
Ubuntu:25.10autogenno fix listedUBUNTU-CVE-2025-8746
Ubuntu:26.04:LTSautogenno fix listedUBUNTU-CVE-2025-8746
Ubuntu:26.10autogenno fix listedUBUNTU-CVE-2025-8746

Affected products (as reported)

VendorProductVersions
GNU libopts 27.027.127.227.327.427.527.6

Weakness: CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References