CVE-2025-14282

Date: December 15, 2025

Dropbear 2025.89 is released. As well as various improvements, this includes a security fix for privilege escalation in Dropbear server. This affects versions 2024.84 to 2025.88, allowing any authenticated user to run arbitrary programs as root (depending on other system programs). A mitigation for affected versions is to disable unix socket forwarding, either with "dropbear -j" runtime argument (will also disable TCP fowarding) or building with localoptions.h / distrooptions.h "#define DROPBEAR_SVR_LOCALSTREAMFWD 0".