Heap-based buffer overflow in OpenWrt - CVE-2025-62526
Published: April 24, 2026
Vulnerability identifier: #VU127514
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-62526
CWE-ID: CWE-122
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in the event registration parsing code when parsing crafted subscription messages. A local user can send a specially crafted message to execute arbitrary code.
The affected code is reached before ACL checks, and the crafted subscription also bypasses the listen ACL.
Affected software
OpenWrt
How to mitigate CVE-2025-62526
Install security update from vendor's website.
OpenWrt - update to 24.10.4