Reachable assertion in Avahi - CVE-2025-68276

Vulnerability identifier: #VU127431

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-68276

CWE-ID: CWE-617

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to reachable assertion in avahi_wide_area_scan_cache when creating a record browser with the AVAHI_LOOKUP_USE_WIDE_AREA flag while wide-area is disabled. A local user can create a crafted record browser request to cause a denial of service.

The issue causes avahi-daemon to terminate with SIGABRT.

Avahi
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Ubuntu
Desktop Applications Module
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Anolis OS
avahi (Ubuntu package)
avahi-lang
avahi-compat-mDNSResponder-devel
libdns_sd-debuginfo-32bit
libavahi-common3-32bit
libavahi-core7
avahi-debuginfo-32bit
libavahi-client3
libavahi-core7-debuginfo
avahi-utils-debuginfo
libavahi-client3-debuginfo-32bit
avahi
avahi-compat-howl-devel
avahi-debugsource
libavahi-common3-debuginfo-32bit
libavahi-common3-debuginfo
libavahi-client3-debuginfo
avahi-utils
libdns_sd
libavahi-devel
libavahi-client3-32bit
libdns_sd-32bit
libavahi-common3
avahi-debuginfo
libdns_sd-debuginfo
python3-avahi
avahi-ui-tools
avahi-ui-gtk3
avahi-ui-devel
avahi-tools
avahi-glib
avahi-qt5-devel
avahi-qt5
avahi-libs
avahi-gobject-devel
avahi-gobject
avahi-glib-devel
avahi-dnsconfd
avahi-devel
avahi-compat-libdns_sd-devel
avahi-autoipd
avahi-compat-howl
avahi-compat-libdns_sd
avahi-help
avahi-ui
libavahi-ui-gtk3-0
libavahi-libevent1-debuginfo
libavahi-qt5-devel
python3-avahi-gtk
libavahi-gobject0
libhowl0
libavahi-qt5-1
libavahi-gobject0-debuginfo
avahi-autoipd-debuginfo
libhowl0-debuginfo
typelib-1_0-Avahi-0_6
libavahi-qt5-1-debuginfo
avahi-glib2-debugsource
libavahi-glib1-debuginfo
avahi-utils-gtk
avahi-qt5-debugsource
libavahi-glib-devel
libdns_sd-64bit-debuginfo
libavahi-glib1-64bit
libavahi-common3-64bit-debuginfo
libavahi-common3-64bit
libavahi-glib1-64bit-debuginfo
libdns_sd-64bit
avahi-64bit-debuginfo
libavahi-client3-64bit
libavahi-client3-64bit-debuginfo
libavahi-client3-32bit-debuginfo
avahi-32bit-debuginfo
libavahi-ui-gtk3-0-debuginfo
avahi-utils-gtk-debuginfo
libavahi-gobject-devel
libavahi-libevent1
libavahi-glib1
libavahi-glib1-32bit-debuginfo
libdns_sd-32bit-debuginfo
libavahi-glib1-32bit
libavahi-common3-32bit-debuginfo
iDRAC10

Install security update from vendor's website.

Avahi - update to 0.9 rc3
avahi (Ubuntu package) - addressed in versions 0.6.31-4ubuntu1.3+esm4, 0.6.32~rc+dfsg-1ubuntu2.3+esm4, 0.7-3.1ubuntu1.3+esm3, 0.7-4ubuntu7.3+esm1, 0.8-5ubuntu5.4, 0.8-13ubuntu6.1, 0.8-16ubuntu3.1
avahi-lang - addressed in versions 0.6.32-32.36.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-compat-mDNSResponder-devel - addressed in versions 0.6.32-32.36.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libdns_sd-debuginfo-32bit - update to 0.6.32-32.36.1
libavahi-common3-32bit - addressed in versions 0.6.32-32.36.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-core7 - addressed in versions 0.6.32-32.36.1, 0.7-150100.3.46.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-debuginfo-32bit - update to 0.6.32-32.36.1
libavahi-client3 - addressed in versions 0.6.32-32.36.1, 0.7-150100.3.46.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-core7-debuginfo - addressed in versions 0.6.32-32.36.1, 0.7-150100.3.46.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-utils-debuginfo - addressed in versions 0.6.32-32.36.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-client3-debuginfo-32bit - update to 0.6.32-32.36.1
avahi - addressed in versions 0.6.32-32.36.1, 0.7-150100.3.46.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-compat-howl-devel - addressed in versions 0.6.32-32.36.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-debugsource - addressed in versions 0.6.32-32.36.1, 0.7-150100.3.46.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-common3-debuginfo-32bit - update to 0.6.32-32.36.1
libavahi-common3-debuginfo - addressed in versions 0.6.32-32.36.1, 0.7-150100.3.46.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-client3-debuginfo - addressed in versions 0.6.32-32.36.1, 0.7-150100.3.46.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-utils - addressed in versions 0.6.32-32.36.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libdns_sd - addressed in versions 0.6.32-32.36.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-devel - addressed in versions 0.6.32-32.36.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-client3-32bit - addressed in versions 0.6.32-32.36.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libdns_sd-32bit - addressed in versions 0.6.32-32.36.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-common3 - addressed in versions 0.6.32-32.36.1, 0.7-150100.3.46.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-debuginfo - addressed in versions 0.6.32-32.36.1, 0.7-150100.3.46.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
libdns_sd-debuginfo - addressed in versions 0.6.32-32.36.1, 0.8-150400.7.26.1, 0.8-150600.15.12.1
python3-avahi - update to 0.8-9
avahi-ui-tools - update to 0.8-9
avahi-ui-gtk3 - update to 0.8-9
avahi-ui-devel - update to 0.8-9
avahi-tools - update to 0.8-9
avahi-glib - update to 0.8-9
avahi-qt5-devel - update to 0.8-9
avahi-qt5 - update to 0.8-9
avahi-libs - update to 0.8-9
avahi-gobject-devel - update to 0.8-9
avahi-gobject - update to 0.8-9
avahi-glib-devel - update to 0.8-9
avahi-dnsconfd - update to 0.8-9
avahi-devel - update to 0.8-9
avahi-compat-libdns_sd-devel - update to 0.8-9
avahi - update to 0.8-9
avahi-autoipd - update to 0.8-9
avahi-compat-howl - update to 0.8-9
avahi-compat-howl-devel - update to 0.8-9
avahi-compat-libdns_sd - update to 0.8-9
avahi-autoipd - update to 0.8-15
avahi - update to 0.8-15
avahi-help - update to 0.8-15
avahi-ui-gtk3 - update to 0.8-15
avahi-ui-devel - update to 0.8-15
avahi-ui - update to 0.8-15
avahi-tools - update to 0.8-15
avahi-qt5-devel - update to 0.8-15
avahi-qt5 - update to 0.8-15
avahi-libs - update to 0.8-15
avahi-gobject-devel - update to 0.8-15
avahi-gobject - update to 0.8-15
avahi-glib-devel - update to 0.8-15
avahi-dnsconfd - update to 0.8-15
avahi-glib - update to 0.8-15
avahi-compat-howl - update to 0.8-15
avahi-compat-howl-devel - update to 0.8-15
avahi-compat-libdns_sd - update to 0.8-15
avahi-compat-libdns_sd-devel - update to 0.8-15
avahi-debuginfo - update to 0.8-15
avahi-debugsource - update to 0.8-15
avahi-devel - update to 0.8-15
libavahi-ui-gtk3-0 - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-libevent1-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-qt5-devel - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
python3-avahi-gtk - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-gobject0 - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libhowl0 - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-autoipd - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
python3-avahi - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-qt5-1 - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-gobject0-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-autoipd-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libhowl0-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
typelib-1_0-Avahi-0_6 - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-qt5-1-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-glib2-debugsource - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-glib1-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-utils-gtk - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-qt5-debugsource - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-glib-devel - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libdns_sd-64bit-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-glib1-64bit - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-common3-64bit-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-common3-64bit - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-glib1-64bit-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libdns_sd-64bit - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-64bit-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-client3-64bit - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-client3-64bit-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-client3-32bit-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-32bit-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-ui-gtk3-0-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
avahi-utils-gtk-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-gobject-devel - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-libevent1 - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-glib1 - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-glib1-32bit-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libdns_sd-32bit-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-glib1-32bit - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
libavahi-common3-32bit-debuginfo - addressed in versions 0.8-150400.7.26.1, 0.8-150600.15.12.1
iDRAC10 - update to 1.30.30.50

• https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc

• Multiple vulnerabilities in Avahi
• openEuler update for avahi
• SUSE update for avahi
• SUSE update for avahi
• SUSE update for avahi
• SUSE update for avahi
• Anolis OS update for avahi
• Ubuntu update for avahi
• Reachable assertion in Dell iDRAC10