Log in Start free

Vulnerability · Published Dec 29, 2025 · Assigned by mitre

CVE-2025-60458

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in the uxplay package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 76.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially crafted RTSP TEARDOWN request can trigger multiple calls to free() on the same memory address, potentially causing a Denial of Service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12uxplayno fix listedDEBIAN-CVE-2025-60458
Debian:13uxplayno fix listedDEBIAN-CVE-2025-60458
Debian:14uxplay1.72.3-1DEBIAN-CVE-2025-60458
Ubuntu:22.04:LTSuxplayno fix listedUBUNTU-CVE-2025-60458
Ubuntu:24.04:LTSuxplayno fix listedUBUNTU-CVE-2025-60458
Ubuntu:25.10uxplayno fix listedUBUNTU-CVE-2025-60458
Ubuntu:26.04:LTSuxplayno fix listedUBUNTU-CVE-2025-60458
Ubuntu:26.10uxplayno fix listedUBUNTU-CVE-2025-60458

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References