CVE-2025-24956

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in OpenV2G (All versions < V0.9.6). The OpenV2G EXI parsing feature is missing a length check when parsing X509 serial numbers. Thus, an attacker could introduce a buffer overflow that leads to memory corruption.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-249579.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_socCVE-2025-249588.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` CVE-2025-249591.0zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variablCVE-2025-249608.7Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(CVE-2025-249616.0org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionaCVE-2025-249628.8reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd paraCVE-2025-249637.5Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on thCVE-2025-249648.8Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious wCVE-2025-249658.5crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handlCVE-2025-249665.4reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanCVE-2025-249675.4reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the adminCVE-2025-249688.8reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with