CVE-2025-32801
Loading a malicious hook library can lead to local privilege escalation
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Loading a malicious hook library can lead to local privilege escalation
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
Reserved 2025-04-10 | Published 2025-05-28 | Updated 2025-05-28 | Assigner iscCWE-94 Improper Control of Generation of Code ('Code Injection')
ISC would like to thank Matthias Gerstner from the SUSE security team and Laura Pardo from Red Hat's Product Security Team for bringing this vulnerability to our attention.
kb.isc.org/docs/cve-2025-32801 (CVE-2025-32801)
Support options
