Buffer overflow in iperf - CVE-2025-54351

Vulnerability identifier: #VU113838

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-54351

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary  when --skip-rx-copy is used (for MSG_TRUNC in recv). A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

iperf
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Enterprise Storage
SUSE Package Hub 15
openSUSE Leap
iperf
libiperf0-debuginfo
iperf-devel
iperf-debuginfo
libiperf0
iperf-debugsource

Install update from vendor's website.

iperf - update to 3.19.1
iperf - update to 3.19.1-150000.3.15.1
libiperf0-debuginfo - update to 3.19.1-150000.3.15.1
iperf-devel - update to 3.19.1-150000.3.15.1
iperf-debuginfo - update to 3.19.1-150000.3.15.1
libiperf0 - update to 3.19.1-150000.3.15.1
iperf-debugsource - update to 3.19.1-150000.3.15.1

• https://github.com/esnet/iperf/commit/969b7f70c447513e92c9798f22e82b40ebc53bf0
• https://github.com/esnet/iperf/releases/tag/3.19.1

• SUSE update for iperf
• Multiple vulnerabilities in iperf