Log in Start free

Vulnerability · Published Aug 15, 2025 · Assigned by VulDB

CVE-2025-9019tcpreplay tcpprep cidr.c mask_cidr6 heap-based overflow

Low 3.1

In plain English

A low-severity heap buffer overflow in tcpreplay. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)1.2%top 31.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in tcpreplay 4.5.1. This vulnerability affects the function mask_cidr6 of the file cidr.c of the component tcpprep. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The researcher is able to reproduce this with the latest official release 4.5.1 and the current master branch. The code maintainer cannot reproduce this for 4.5.2-beta1. In his reply the maintainer explains that "[i]n that case, this is a duplicate that was fixed in 4.5.2."

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12tcpreplayno fix listedDEBIAN-CVE-2025-9019
Debian:13tcpreplayno fix listedDEBIAN-CVE-2025-9019
Debian:14tcpreplay4.5.2-1DEBIAN-CVE-2025-9019
Ubuntu:25.10tcpreplayno fix listedUBUNTU-CVE-2025-9019
Ubuntu:26.04:LTStcpreplayno fix listedUBUNTU-CVE-2025-9019
Ubuntu:26.10tcpreplayno fix listedUBUNTU-CVE-2025-9019

Affected products (as reported)

VendorProductVersions
n/a tcpreplay 4.5.1

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

References