Log in Start free

Vulnerability · Published Aug 19, 2025 · Assigned by VulDB

CVE-2025-9157appneta tcpreplay tcprewrite edit_packet.c untrunc_packet use after free

Medium 5.3

In plain English

A medium-severity use-after-free in tcpreplay from appneta. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 95.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in appneta tcpreplay up to 4.5.2-beta2. The impacted element is the function untrunc_packet of the file src/tcpedit/edit_packet.c of the component tcprewrite. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. This patch is called 73008f261f1cdf7a1087dc8759115242696d35da. Applying a patch is advised to resolve this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12tcpreplayno fix listedDEBIAN-CVE-2025-9157
Debian:13tcpreplayno fix listedDEBIAN-CVE-2025-9157
Debian:14tcpreplay4.5.2-1DEBIAN-CVE-2025-9157
Ubuntu:25.10tcpreplayno fix listedUBUNTU-CVE-2025-9157
Ubuntu:26.04:LTStcpreplayno fix listedUBUNTU-CVE-2025-9157
Ubuntu:26.10tcpreplayno fix listedUBUNTU-CVE-2025-9157

Affected products (as reported)

VendorProductVersions
appneta tcpreplay 4.5.2-beta14.5.2-beta2

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References