CVE-2025-29481

At a glance

Severity
MEDIUM 6.2
EPSS
EPSS 0.24 % · percentile 15 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
mitre
NVD status
Modified

Description

Buffer Overflow vulnerability in libbpf 1.5.0 allows a local attacker to execute arbitrary code via the bpf_object__init_prog` function of libbpf. This has been disputed by third parties who assert that "no one in their sane mind should be passing untrusted ELF files into libbpf while running under root."

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCISA-ADP
CVSS 3.1MEDIUM 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Weaknesses (CWE)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
affected n/a

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD