CVE-2025-54409

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

• CWE-476

• https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135aPatch
• https://github.com/aide/aide/releases/tag/v0.19.2Release Notes
• https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxhExploit, Mitigation, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2025/08/14/8
• https://lists.debian.org/debian-lts-announce/2025/08/msg00011.html
• https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxhExploit, Mitigation, Vendor Advisory

Published

Aug 14, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54402Multiple stack-based buffer overflow vulnerabilities exist i…8.8
• CVE-2025-54403Multiple OS command injection vulnerabilities exist in the s…8.8
• CVE-2025-54404Multiple OS command injection vulnerabilities exist in the s…8.8
• CVE-2025-54405Multiple OS command injection vulnerabilities exist in the f…8.8
• CVE-2025-54406Multiple OS command injection vulnerabilities exist in the f…8.8
• CVE-2025-54407Stored cross-site scripting vulnerability exists in GroupSes…6.1
• CVE-2025-5441A vulnerability classified as critical was found in Linksys …9.8
• CVE-2025-54410Moby is an open source container framework developed by Dock…5.2
• CVE-2025-54411Discourse is an open-source discussion platform. Welcome ban…5.4
• CVE-2025-54412skops is a Python library which helps users share and ship t…8.7
• CVE-2025-54413skops is a Python library which helps users share and ship t…8.7
• CVE-2025-54414Anubis is a Web AI Firewall Utility that weighs the soul of …5.1