CVE-2025-7208

low-risk
Published 2025-07-09

A vulnerability was found in 9fans plan9port up to 9da5b44. It has been classified as critical. This affects the function edump in the library /src/plan9port/src/libsec/port/x509.c. The manipulation leads to heap-based buffer overflow. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is b3e06559475b0130a7a2fb56ac4d131d13d2012f. It is recommended to apply a patch to fix this issue.

Do I need to act?

-
0.19% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
ADJACENT_NETWORK / LOW complexity

Affected Products (1)

Plan9Port

Affected Vendors

9Fans

References (8)

Product https://drive.google.com/drive/folders/1kedwNLNDiFQB2OAp7S-ZKYoF7nxfIZGO?usp=sha...
Patch https://git.9front.org/plan9front/plan9front/b3e06559475b0130a7a2fb56ac4d131d13d...
Patch https://github.com/9fans/plan9port/issues/710#issuecomment-2819906648
Exploit https://github.com/user-attachments/files/19698345/plan9port_crash_1.txt
Permissions Required https://vuldb.com/?ctiid.259053
Third Party Advisory https://vuldb.com/?id.259053
Third Party Advisory https://vuldb.com/?submit.304567
Third Party Advisory https://vuldb.com/?submit.607684
24
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal