CVE-2025-0577

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

An insufficient entropy vulnerability was found in glibc. The getrandom and arc4random family of functions may return predictable randomness if these functions are called again after the fork, which happens concurrently with a call to any of these functions.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-331

Affected software

No affected versions have been published.

Timeline

Published: Feb 18, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-05783.5A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown functi CVE-2025-05797.3A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unkno CVE-2025-05805.6A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown function CVE-2025-05815.4A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. This affects an unknown part of the fi CVE-2025-05827.2A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code o CVE-2025-05836.1The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute a CVE-2025-05845.3The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerability CVE-2025-05859.8The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL comma CVE-2025-05867.2The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privil CVE-2025-05877.8in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. Thi CVE-2025-05884.9In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By s CVE-2025-05895.3In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated