Heap Buffer Overflow in OpenWrt Ubusd Affects Embedded Devices

CVE-2025-62526

What is CVE-2025-62526?

The OpenWrt Project, a Linux operating system designed for embedded devices, contains a vulnerability in the ubusd service prior to version 24.10.4. This vulnerability is a heap buffer overflow in the event registration parsing code, which can allow attackers to manipulate the memory head and potentially execute arbitrary code in the memory context of the ubus daemon. The flaw occurs before running Access Control List (ACL) checks, making it possible for any ubus client to send harmful messages. Additionally, this crafted subscription allows an attacker to bypass the listen ACL restrictions, which could further compromise system integrity. The issue is currently addressed and patched in OpenWrt version 24.10.4.

References