CVE-2025-9001

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was determined in LemonOS up to nightly-2024-07-12 on LemonOS. Affected by this issue is the function HTTPGet of the file /Applications/Steal/main.cpp of the component HTTP Client. The manipulation of the argument chunkSize leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119 CWE-121 CWE-787

Affected software

Vendor	Product	Versions
n/a	LemonOS	nightly-2024-07-12

References

https://github.com/LemonOSProject/LemonOS/issues/60Exploit, Issue Tracking, Vendor Advisory
https://hkohi.ca/vulnerability/16Exploit, Third Party Advisory
https://vuldb.com/?ctiid.320030Permissions Required, VDB Entry
https://vuldb.com/?id.320030Third Party Advisory, VDB Entry
https://vuldb.com/?submit.624974Exploit, Third Party Advisory, VDB Entry
https://github.com/LemonOSProject/LemonOS/issues/60Exploit, Issue Tracking, Vendor Advisory
https://hkohi.ca/vulnerability/16Exploit, Third Party Advisory
https://vuldb.com/?submit.624974Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Aug 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-90029.8A vulnerability was identified in Surbowl dormitory-management-php 1.0. This affects an unknown part of the file login.php. The manipulation CVE-2025-90035.4A vulnerability has been found in D-Link DIR-818LW 1.04. This vulnerability affects unknown code of the file /bsc_lan.php of the component D CVE-2025-90049.1A vulnerability was found in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /settings/password. The manipul CVE-2025-90053.7A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to CVE-2025-90068.8A vulnerability was identified in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function formdelFileName of the file /goform/del CVE-2025-90078.8A vulnerability has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formeditFileName of the file /goform/editFileNa CVE-2025-90089.8A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of t CVE-2025-90099.8A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /ad CVE-2025-90109.8A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. Affected by this vulnerability is an unknown functio CVE-2025-90119.8A vulnerability was determined in PHPGurukul Online Shopping Portal Project 2.0. Affected by this issue is some unknown functionality of the CVE-2025-90129.8A vulnerability was identified in PHPGurukul Online Shopping Portal Project 2.0. This affects an unknown part of the file shopping/bill-ship CVE-2025-90139.8A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.0. This vulnerability affects unknown code of the file /shoppi