CVE-2025-62526

OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code in the context of the ubus daemon. The affected code is executed before running the ACL checks, all ubus clients are able to send such messages. In addition to the heap corruption, the crafted subscription also results in a bypass of the listen ACL. This is fixed in OpenWrt 24.10.4. There are no workarounds.

• CWE-122

• https://github.com/openwrt/openwrt/commit/4b907e69ea58fc0ba35fd1755dc4ba22262af3a4Patch
• https://github.com/openwrt/openwrt/commit/a7901969932a175cded3c93bdeb65f32ed3705e6Patch
• https://github.com/openwrt/openwrt/security/advisories/GHSA-cp32-65v4-cp73Patch, Vendor Advisory
• https://github.com/openwrt/ubus/commit/60e04048a0e2f3e33651c19e62861b41be4c290fPatch
• https://github.com/openwrt/ubus/commit/aa4a7ee1d3417bc11207ad0a78d579ece7fe0c13Patch
• https://github.com/openwrt/ubus/commit/d31effb4277bd557f5ccf16d909422718c1e49d0Patch
• https://openwrt.org/advisory/2025-10-22-1Third Party Advisory

Published

Oct 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62520Mantis Bug Tracker (MantisBT) is an open source issue tracke…4.3
• CVE-2025-62521ChurchCRM is an open-source church management system. Prior …9.8
• CVE-2025-62522Vite is a frontend tooling framework for JavaScript. In vers…6
• CVE-2025-62523PILOS (Platform for Interactive Live-Online Seminars) is a f…6.3
• CVE-2025-62524PILOS (Platform for Interactive Live-Online Seminars) is a f…5.3
• CVE-2025-62525OpenWrt Project is a Linux operating system targeting embedd…8.8
• CVE-2025-62527Taguette is an open source qualitative research tool. An iss…7.1
• CVE-2025-62528Taguette is an open source qualitative research tool. An iss…5.4
• CVE-2025-6253The UiCore Elements – Free Elementor widgets and templates p…7.5
• CVE-2025-6254The Doctreat Core plugin for WordPress is vulnerable to Priv…9.8
• CVE-2025-62549Untrusted pointer dereference in Windows Routing and Remote …8.8
• CVE-2025-6255The Dynamic AJAX Product Filters for WooCommerce plugin for …6.4