CVE-2025-7464 | THREATINT

Description

A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue.

Es wurde eine problematische Schwachstelle in osrg GoBGP bis 3.37.0 entdeckt. Hiervon betroffen ist die Funktion SplitRTR der Datei pkg/packet/rtr/rtr.go. Durch das Beeinflussen mit unbekannten Daten kann eine out-of-bounds read-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Die Komplexität eines Angriffs ist eher hoch. Sie gilt als schwierig auszunutzen. Der Patch wird als e748f43496d74946d14fed85c776452e47b99d64 bezeichnet. Als bestmögliche Massnahme wird Patching empfohlen.

Reserved 2025-07-11 | Published 2025-07-12 | Updated 2025-07-12 | Assigner VulDB

MEDIUM: 6.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

LOW: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

LOW: 3.7CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

2.6AV:N/AC:H/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C

Problem types

Out-of-Bounds Read

Memory Corruption

Product status

3.0

affected

3.1

affected

3.2

affected

3.3

affected

3.4

affected

3.5

affected

3.6

affected

3.7

affected

3.8

affected

3.9

affected

3.10

affected

3.11

affected

3.12

affected

3.13

affected

3.14

affected

3.15

affected

3.16

affected

3.17

affected

3.18

affected

3.19

affected

3.20

affected

3.21

affected

3.22

affected

3.23

affected

3.24

affected

3.25

affected

3.26

affected

3.27

affected

3.28

affected

3.29

affected

3.30

affected

3.31

affected

3.32

affected

3.33

affected

3.34

affected

3.35

affected

3.36

affected

3.37.0

affected

Timeline

2025-07-11:	Advisory disclosed
2025-07-11:	VulDB entry created
2025-07-11:	VulDB entry last update

Credits

CyberGym (VulDB User) reporter

References

vuldb.com/?id.316116 (VDB-316116 | osrg GoBGP rtr.go SplitRTR out-of-bounds) vdb-entry technical-description

vuldb.com/?ctiid.316116 (VDB-316116 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.610193 (Submit #610193 | NTT Open Source GoBGP defe9ac1b1f1c854d1941a5b70dee3aaed6fb960 Out-of-Bounds Read) third-party-advisory

github.com/...ommit/e748f43496d74946d14fed85c776452e47b99d64 patch

cve.org (CVE-2025-7464)

nvd.nist.gov (CVE-2025-7464)

Download JSON