Untrusted search path in Kea - CVE-2025-32801

Vulnerability identifier: #VU112080

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-32801

CWE-ID: CWE-426

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an untrusted search path. A local user can place a malicious binary into a specific location on the system and execute arbitrary code with escalated privileges.

Kea
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Fedora
Basesystem Module
Server Applications Module
openSUSE Leap
kea
kea (Red Hat package)
libkea-process74-debuginfo
libkea-dns++57-debuginfo
libkea-dhcp_ddns57-debuginfo
libkea-cryptolink50-debuginfo
kea-devel
libkea-stats41
libkea-util-io0-debuginfo
libkea-hooks100-debuginfo
libkea-process74
libkea-stats41-debuginfo
libkea-tcp19-debuginfo
libkea-asiolink72-debuginfo
libkea-d2srv47
libkea-util86-debuginfo
libkea-cryptolink50
libkea-dns++57
libkea-asiodns49-debuginfo
kea-hooks-debuginfo
libkea-util86
kea-debuginfo
libkea-log61
libkea-eval69
libkea-cfgclient66-debuginfo
libkea-exceptions33-debuginfo
libkea-dhcpsrv111
python3-kea
kea-doc
libkea-pgsql71
libkea-dhcp++92-debuginfo
libkea-asiolink72
libkea-util-io0
libkea-cc68-debuginfo
libkea-asiodns49
libkea-dhcpsrv111-debuginfo
libkea-http72
libkea-tcp19
libkea-http72-debuginfo
libkea-hooks100
libkea-pgsql71-debuginfo
libkea-database62
libkea-cc68
libkea-eval69-debuginfo
libkea-mysql71-debuginfo
kea-debugsource
libkea-cfgclient66
libkea-mysql71
libkea-log61-debuginfo
libkea-database62-debuginfo
libkea-d2srv47-debuginfo
libkea-dhcp_ddns57
libkea-dhcp++92
kea-hooks
libkea-exceptions33

Install updates from vendor's website.

Kea - addressed in versions 2.4.2, 2.6.3, 2.7.9
kea - addressed in versions 2.6.3-1.el9, 2.6.3-1.fc41, 2.6.3-1.fc42
kea (Red Hat package) - update to 2.6.3-1.el10_0
libkea-process74-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dns++57-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcp_ddns57-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cryptolink50-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-devel - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-stats41 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-util-io0-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-hooks100-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-process74 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-stats41-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-tcp19-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-asiolink72-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-d2srv47 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-util86-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cryptolink50 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dns++57 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-asiodns49-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-hooks-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-util86 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-log61 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-eval69 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cfgclient66-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-exceptions33-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcpsrv111 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
python3-kea - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-doc - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-pgsql71 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcp++92-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-asiolink72 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-util-io0 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cc68-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-asiodns49 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcpsrv111-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-http72 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-tcp19 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-http72-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-hooks100 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-pgsql71-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-database62 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cc68 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-eval69-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-mysql71-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-debugsource - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cfgclient66 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-mysql71 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-log61-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-database62-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-d2srv47-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcp_ddns57 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcp++92 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-hooks - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-exceptions33 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5

• https://kb.isc.org/docs/cve-2025-32801

• Multiple vulnerabilities in ISC Kea
• Fedora 42 update for kea
• Fedora 41 update for kea
• Fedora EPEL 9 update for kea
• Red Hat Enterprise Linux 10 update for kea
• SUSE update for kea
• SUSE update for kea