CVE-2025-34468

Katalog CVE

CVSS 9.8 · Critical EPSS 0,75%

Kerentanan Stack-based Buffer Overflow pada libcoap. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without proper bounds checking. A remote attacker can trigger a crash and potentially achieve remote code execution depending on compiler options and runtime memory protections. Exploitation requires the proxy logic to be enabled (i.e., the proxy request handling code path in an application using libcoap).

Rincian

Terbit di NVD

31 Desember 2025

Terakhir diubah

23 September 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/obgm/libcoap/commit/30db3ea patch
• https://www.vulncheck.com/advisories/libcoap-stack-based-buffer-overflow-in-address-resolution-dos-or-potentia... advisory pihak ketiga
• https://github.com/obgm/libcoap/pull/1737 issue tracking
• https://libcoap.net/ product