OpenWrt Project up to 24.10.3 ubusd heap-based overflow

Summaryinfo

A vulnerability has been found in OpenWrt Project up to 24.10.3 and classified as critical. This affects an unknown function of the component ubusd. The manipulation leads to heap-based overflow. This vulnerability is documented as CVE-2025-62526. The attack needs to be performed locally. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in OpenWrt Project up to 24.10.3. It has been rated as critical. This issue affects an unknown part of the component ubusd. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code in the context of the ubus daemon. The affected code is executed before running the ACL checks, all ubus clients are able to send such messages. In addition to the heap corruption, the crafted subscription also results in a bypass of the listen ACL. This is fixed in OpenWrt 24.10.4. There are no workarounds.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-62526 since 10/15/2025. The exploitation is known to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 276831 (Linux Distros Unpatched Vulnerability : CVE-2025-62526), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 24.10.4 eliminates this vulnerability. Applying the patch 4b907e69ea58fc0ba35fd1755dc4ba22262af3a4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (276831). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Project Management Software

Name

• OpenWrt Project

Version

• 24.10.0
• 24.10.1
• 24.10.2
• 24.10.3

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion