← Vulnerability feed

Vulnerability record · CVE-2025-9019 · published 15 August 2025

CVE-2025-9019: Broadcom tcpreplay memory buffer overflow vulnerability

Broadcom · Tcpreplay

A vulnerability has been found in tcpreplay 4.5.1. This vulnerability affects the function mask_cidr6 of the file cidr.c of the component tcpprep. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The researcher is able to reproduce this with the latest official release 4.5.1 and the current master branch. The code maintainer cannot reproduce this for 4.5.2-beta1. In his reply the maintainer explains that "[i]n that case, this is a duplicate that was fixed in 4.5.2."

1.3 CVSS 4.0 Low EPSS 1.00% · top 38.6% CWE-119 · Memory buffer overflowCWE-122 · Heap-based buffer overflow
1.3CVSS 4.0 base score, v2 2.6
1.00%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
14References, 12 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability has been found in tcpreplay 4.5.1. This vulnerability affects the function mask_cidr6 of the file cidr.c of the component tcpprep. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The researcher is able to reproduce this with the latest official release 4.5.1 and the current master branch. The code maintainer cannot reproduce this for 4.5.2-beta1. In his reply the maintainer explains that "[i]n that case, this is a duplicate that was fixed in 4.5.2."

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://drive.google.com/file/d/13SQYVIb_YQoRfaJaaLf6iLtMiCRCHlBc/view?usp=sharing Exploit
https://github.com/appneta/tcpreplay/issues/958 ExploitIssue TrackingPatchVendor Advisory
https://github.com/appneta/tcpreplay/issues/958#issuecomment-3124876035 ExploitIssue TrackingPatchVendor Advisory
https://github.com/appneta/tcpreplay/issues/959 ExploitIssue TrackingVendor Advisory
https://vuldb.com/?ctiid.320080 Permissions RequiredVDB Entry
https://vuldb.com/?id.320080 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.623635 ExploitThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.623636 ExploitThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.623637 ExploitThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.623638 ExploitThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.623639 ExploitThird Party AdvisoryVDB Entry
https://github.com/appneta/tcpreplay/issues/958 ExploitIssue TrackingPatchVendor Advisory
https://github.com/appneta/tcpreplay/issues/959 ExploitIssue TrackingVendor Advisory
https://vuldb.com/?submit.623639 ExploitThird Party AdvisoryVDB Entry

Track CVE-2025-9019 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-18408Broadcom tcpreplay use after free vulnerabilityA use-after-free was discovered in the tcpbridge binary of Tcpreplay 4.3.0 beta1. The issue gets triggered in the function post_args() at tcpbridge.c…EPSS 2.3%9.1CVE-2020-12740Broadcom tcpreplay out-of-bounds read vulnerabilitytcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation. The issue is being triggered in the function get_ip…EPSS 1.7%7.8CVE-2025-51006Broadcom tcpreplay double free vulnerabilityWithin tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linux…EPSS 0.19%7.8CVE-2024-3024Broadcom tcpreplay heap-based buffer overflow vulnerabilityA vulnerability was found in appneta tcpreplay up to 4.4.4. It has been classified as problematic. This affects the function get_layer4_v6 of the fil…EPSS 0.44%7.8CVE-2022-37049Broadcom tcpreplay out-of-bounds write vulnerabilityThe component tcpprep in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in parse_mpls at common/get.c:150. NOTE: this is dif…EPSS 0.42%7.8CVE-2022-37047Broadcom tcpreplay out-of-bounds write vulnerabilityThe component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_ipv6_next at common/get.c:713. NOTE: this …EPSS 0.42%7.8CVE-2022-37048Broadcom tcpreplay out-of-bounds write vulnerabilityThe component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_l2len_protocol at common/get.c:344. NOTE: …EPSS 0.42%7.8CVE-2022-27416Broadcom tcpreplay double free vulnerabilityTcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free.EPSS 0.84%

Source: NIST National Vulnerability Database (record CVE-2025-9019), CISA KEV, FIRST EPSS (scores of 2026-10-05). This page is refreshed as NVD updates the record.