CVE-2025-34457

{
  "id": "CVE-2025-34457",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-22T22:16:04.493",
  "lastModified": "2026-10-29T21:17:04.743",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, contain a stack-based buffer overflow vulnerability in the function kiss_rec_byte() located in src/kiss_frame.c. When processing crafted KISS frames that reach the maximum allowed frame length (MAX_KISS_LEN), the function appends a terminating FEND byte without reserving sufficient space in the stack buffer. This results in an out-of-bounds write followed by an out-of-bounds read during the subsequent call to kiss_unwrap(), leading to stack memory corruption or application crashes. This vulnerability may allow remote unauthenticated attackers to trigger a denial-of-service condition."
    },
    {
      "lang": "es",
      "value": "wb2osz/direwolf (Dire Wolf) versiones hasta e incluyendo 1.8, versiones anteriores al commit 694c954, contienen una vulnerabilidad de desbordamiento de búfer basado en pila en la función kiss_rec_byte() ubicada en src/kiss_frame.c. Al procesar tramas KISS manipuladas que alcanzan la longitud máxima de trama permitida (MAX_KISS_LEN), la función añade un byte FEND de terminación sin reservar espacio suficiente en el búfer de pila. Esto resulta en una escritura fuera de límites seguida de una lectura fuera de límites durante la llamada subsiguiente a kiss_unwrap(), lo que lleva a corrupción de memoria de pila o bloqueos de la aplicación. Esta vulnerabilidad puede permitir a atacantes remotos no autenticados desencadenar una condición de denegación de servicio."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "wb2osz",
          "product": "Dire Wolf",
          "defaultStatus": "unaffected",
          "packageName": "direwolf",
          "repo": "https://github.com/wb2osz/direwolf",
          "packageURL": "pkg:github/wb2osz/direwolf",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.8.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "694c95485b21c1c22bc4682703771dec4d7a374b",
              "versionType": "git",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-22T21:53:46.294245Z",
          "id": "CVE-2025-34457",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-010-direwolf-stack-buffer-overflow-kiss-frame.md",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/wb2osz/direwolf/commit/694c954",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/wb2osz/direwolf/issues/617",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/wb2osz-direwolf-stack-based-buffer-overflow-dos",
      "source": "[email protected]"
    }
  ]
}