CVE-2025-1674

HighCVSS 8.2/10Last modified Oct 13, 2026

Description

A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Feb 25, 2025
Last modified
Oct 13, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-16759.1The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffCVE-2025-16769.8A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the funcCVE-2025-16777.5A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.1CVE-2025-16794.8Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject maliciCVE-2025-16800.0An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attCVE-2025-16815.4The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and CVE-2025-16828.8The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability chCVE-2025-16837.8Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an attacker with local CVE-2025-16864.9Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the inCVE-2025-16878.8The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missinCVE-2025-16885.5Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after thCVE-2025-16895.4The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in vers
CVE-2025-1674: High severity, CVSS 8.2 | Vulnix