CVE-2025-34457

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-34457", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-04-15T19:15:22.603Z", "datePublished": "2025-12-22T21:30:29.670Z", "dateUpdated": "2026-10-29T21:15:15.325Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "direwolf", "packageURL": "pkg:github/wb2osz/direwolf", "product": "Dire Wolf", "repo": "https://github.com/wb2osz/direwolf", "vendor": "wb2osz", "versions": [{"lessThanOrEqual": "1.8.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "694c95485b21c1c22bc4682703771dec4d7a374b", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Vlatko Kosturjak with Marlink Cyber"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, contain a stack-based buffer overflow vulnerability in the function kiss_rec_byte() located in src/kiss_frame.c. When processing crafted KISS frames that reach the maximum allowed frame length (MAX_KISS_LEN), the function appends a terminating FEND byte without reserving sufficient space in the stack buffer. This results in an out-of-bounds write followed by an out-of-bounds read during the subsequent call to kiss_unwrap(), leading to stack memory corruption or application crashes. This vulnerability may allow remote unauthenticated attackers to trigger a denial-of-service condition."}], "value": "wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, contain a stack-based buffer overflow vulnerability in the function kiss_rec_byte() located in src/kiss_frame.c. When processing crafted KISS frames that reach the maximum allowed frame length (MAX_KISS_LEN), the function appends a terminating FEND byte without reserving sufficient space in the stack buffer. This results in an out-of-bounds write followed by an out-of-bounds read during the subsequent call to kiss_unwrap(), leading to stack memory corruption or application crashes. This vulnerability may allow remote unauthenticated attackers to trigger a denial-of-service condition."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T21:15:15.325Z"}, "references": [{"tags": ["technical-description", "exploit"], "url": "https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-010-direwolf-stack-buffer-overflow-kiss-frame.md"}, {"tags": ["issue-tracking"], "url": "https://github.com/wb2osz/direwolf/issues/617"}, {"tags": ["patch"], "url": "https://github.com/wb2osz/direwolf/commit/694c954"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/wb2osz-direwolf-stack-based-buffer-overflow-dos"}], "source": {"discovery": "UNKNOWN"}, "title": "wb2osz/direwolf <= 1.8.1 Stack-based Buffer Overflow DoS", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-22T21:53:46.294245Z", "id": "CVE-2025-34457", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-22T21:53:54.134Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-34457", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-22T21:53:46.294245Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-22T21:53:49.373Z"}}], "cna": {"title": "wb2osz/direwolf <= 1.8.1 Stack-based Buffer Overflow DoS", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Vlatko Kosturjak with Marlink Cyber"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/wb2osz/direwolf", "vendor": "wb2osz", "product": "Dire Wolf", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.8.1"}, {"status": "unaffected", "version": "694c95485b21c1c22bc4682703771dec4d7a374b", "versionType": "git"}], "packageURL": "pkg:github/wb2osz/direwolf", "packageName": "direwolf", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-010-direwolf-stack-buffer-overflow-kiss-frame.md", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/wb2osz/direwolf/issues/617", "tags": ["issue-tracking"]}, {"url": "https://github.com/wb2osz/direwolf/commit/694c954", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/wb2osz-direwolf-stack-based-buffer-overflow-dos", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, contain a stack-based buffer overflow vulnerability in the function kiss_rec_byte() located in src/kiss_frame.c. When processing crafted KISS frames that reach the maximum allowed frame length (MAX_KISS_LEN), the function appends a terminating FEND byte without reserving sufficient space in the stack buffer. This results in an out-of-bounds write followed by an out-of-bounds read during the subsequent call to kiss_unwrap(), leading to stack memory corruption or application crashes. This vulnerability may allow remote unauthenticated attackers to trigger a denial-of-service condition.", "supportingMedia": [{"type": "text/html", "value": "wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, contain a stack-based buffer overflow vulnerability in the function kiss_rec_byte() located in src/kiss_frame.c. When processing crafted KISS frames that reach the maximum allowed frame length (MAX_KISS_LEN), the function appends a terminating FEND byte without reserving sufficient space in the stack buffer. This results in an out-of-bounds write followed by an out-of-bounds read during the subsequent call to kiss_unwrap(), leading to stack memory corruption or application crashes. This vulnerability may allow remote unauthenticated attackers to trigger a denial-of-service condition.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-29T21:15:15.325Z"}}}, "cveMetadata": {"cveId": "CVE-2025-34457", "state": "PUBLISHED", "dateUpdated": "2026-10-29T21:15:15.325Z", "dateReserved": "2025-04-15T19:15:22.603Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-12-22T21:30:29.670Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "direwolf", "packageURL": "pkg:github/wb2osz/direwolf", "product": "Dire Wolf", "repo": "https://github.com/wb2osz/direwolf", "vendor": "wb2osz", "versions": [{"lessThanOrEqual": "1.8.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "694c95485b21c1c22bc4682703771dec4d7a374b", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, contain a stack-based buffer overflow vulnerability in the function kiss_rec_byte() located in src/kiss_frame.c. When processing crafted KISS frames that reach the maximum allowed frame length (MAX_KISS_LEN), the function appends a terminating FEND byte without reserving sufficient space in the stack buffer. This results in an out-of-bounds write followed by an out-of-bounds read during the subsequent call to kiss_unwrap(), leading to stack memory corruption or application crashes. This vulnerability may allow remote unauthenticated attackers to trigger a denial-of-service condition."}, {"lang": "es", "value": "wb2osz/direwolf (Dire Wolf) versiones hasta e incluyendo 1.8, versiones anteriores al commit 694c954, contienen una vulnerabilidad de desbordamiento de b\u00fafer basado en pila en la funci\u00f3n kiss_rec_byte() ubicada en src/kiss_frame.c. Al procesar tramas KISS manipuladas que alcanzan la longitud m\u00e1xima de trama permitida (MAX_KISS_LEN), la funci\u00f3n a\u00f1ade un byte FEND de terminaci\u00f3n sin reservar espacio suficiente en el b\u00fafer de pila. Esto resulta en una escritura fuera de l\u00edmites seguida de una lectura fuera de l\u00edmites durante la llamada subsiguiente a kiss_unwrap(), lo que lleva a corrupci\u00f3n de memoria de pila o bloqueos de la aplicaci\u00f3n. Esta vulnerabilidad puede permitir a atacantes remotos no autenticados desencadenar una condici\u00f3n de denegaci\u00f3n de servicio."}], "id": "CVE-2025-34457", "lastModified": "2026-10-29T21:17:04.743", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34457", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-22T21:53:46.294245Z", "version": "2.0.3"}}]}, "published": "2025-12-22T22:16:04.493", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-010-direwolf-stack-buffer-overflow-kiss-frame.md"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/wb2osz/direwolf/commit/694c954"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/wb2osz/direwolf/issues/617"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/wb2osz-direwolf-stack-based-buffer-overflow-dos"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/wb2osz/direwolf: Dire Wolf: Denial of Service due to stack-based buffer overflow in KISS frame processing", "id": "2424513", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424513"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-121", "details": ["No description is available for this CVE."], "name": "CVE-2025-34457", "public_date": "2025-12-22T21:30:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-34457\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-34457\nhttps://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-010-direwolf-stack-buffer-overflow-kiss-frame.md\nhttps://github.com/wb2osz/direwolf/commit/694c954\nhttps://github.com/wb2osz/direwolf/issues/617\nhttps://www.vulncheck.com/advisories/wb2osz-direwolf-stack-based-buffer-overflow-dos"], "statement": "This vulnerability is rated IMPORTANT as Dire Wolf, available in Fedora, is susceptible to a denial-of-service condition. A remote unauthenticated attacker can exploit a stack-based buffer overflow by sending specially crafted KISS frames, leading to application crashes.", "threat_severity": "Important"}

{"created": "2025-12-24T11:53:26.195054+00:00", "updated": "2025-12-24T11:53:26.195081+00:00", "vendors": ["wb2osz", "wb2osz$PRODUCT$dire_wolf"]}