Improper Initialization in FreeBSD - CVE-2025-0662
Published: January 29, 2025 / Updated: July 30, 2026
Vulnerability identifier: #VU140496
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-0662
CWE-ID: CWE-665
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper initialization in the ktrace facility when copying a variable-sized sockaddr to userspace. A local user can trigger kernel trace logging to disclose sensitive information.
Up to 14 bytes of uninitialized kernel heap memory may be copied to userspace.
Affected software
FreeBSD
How to mitigate CVE-2025-0662
Install security update from vendor's website.