Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-62526

Date: October 22, 2025

OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code in the context of the ubus daemon. The affected code is executed before running the ACL checks, all ubus clients are able to send such messages. In addition to the heap corruption, the crafted subscription also results in a bypass of the listen ACL. This is fixed in OpenWrt 24.10.4. There are no workarounds.

Severity Score

Related Resources (9)

https://github.com/openwrt/ubus/commit/60e04048a0e2f3e33651c19e62861b41be4c290f
https://nvd.nist.gov/vuln/detail/CVE-2025-62526
https://github.com/openwrt/openwrt/commit/4b907e69ea58fc0ba35fd1755dc4ba22262af3a4
https://github.com/openwrt/ubus/commit/aa4a7ee1d3417bc11207ad0a78d579ece7fe0c13
https://github.com/openwrt/openwrt/security/advisories/GHSA-cp32-65v4-cp73
https://openwrt.org/advisory/2025-10-22-1
https://github.com/openwrt/ubus/commit/d31effb4277bd557f5ccf16d909422718c1e49d0
https://github.com/openwrt/openwrt/commit/a7901969932a175cded3c93bdeb65f32ed3705e6
https://www.mend.io/vulnerability-database/CVE-2025-62526

Severity Score

Weakness Type (CWE)

Heap-based Buffer Overflow

CWE-122

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): HIGH

Do you need more information?

Contact Us