Vulnerability record · CVE-2025-9385 · published 24 August 2025

CVE-2025-9385: Broadcom tcpreplay memory buffer overflow vulnerability

Broadcom · Tcpreplay

A flaw has been found in appneta tcpreplay up to 4.5.1. The affected element is the function fix_ipv6_checksums of the file edit_packet.c of the component tcprewrite. This manipulation causes use after free. The attack is restricted to local execution. The exploit has been published and may be used. Upgrading to version 4.5.2-beta3 is sufficient to fix this issue. It is advisable to upgrade the affected component.

1.9 CVSS 4.0 Low EPSS 0.24% · top 85.9% CWE-119 · Memory buffer overflowCWE-416 · Use after free

1.9CVSS 4.0 base score, v2 4.3

0.24%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Tcpreplay Broadcom

References

Link	Tags
https://drive.google.com/file/d/1BQZF558bRHv07wtlCoZgtqTlEpHgfytp/view?usp=sharing	Exploit
https://github.com/appneta/tcpreplay/issues/972	ExploitIssue TrackingVendor Advisory
https://github.com/appneta/tcpreplay/issues/972#issuecomment-3199019278	Issue Tracking
https://vuldb.com/?ctiid.321218	Permissions RequiredVDB Entry
https://vuldb.com/?id.321218	Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.630497	Third Party AdvisoryVDB Entry

Track CVE-2025-9385 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-18408Broadcom tcpreplay use after free vulnerabilityA use-after-free was discovered in the tcpbridge binary of Tcpreplay 4.3.0 beta1. The issue gets triggered in the function post_args() at tcpbridge.c…EPSS 2.3%17 Oct 2018 9.1CVE-2020-12740Broadcom tcpreplay out-of-bounds read vulnerabilitytcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation. The issue is being triggered in the function get_ip…EPSS 1.7%8 May 2020 7.8CVE-2025-51006Broadcom tcpreplay double free vulnerabilityWithin tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linux…EPSS 0.19%22 Sep 2025 7.8CVE-2024-3024Broadcom tcpreplay heap-based buffer overflow vulnerabilityA vulnerability was found in appneta tcpreplay up to 4.4.4. It has been classified as problematic. This affects the function get_layer4_v6 of the fil…EPSS 0.44%28 Mar 2024 7.8CVE-2022-37049Broadcom tcpreplay out-of-bounds write vulnerabilityThe component tcpprep in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in parse_mpls at common/get.c:150. NOTE: this is dif…EPSS 0.42%18 Aug 2022 7.8CVE-2022-37047Broadcom tcpreplay out-of-bounds write vulnerabilityThe component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_ipv6_next at common/get.c:713. NOTE: this …EPSS 0.42%18 Aug 2022 7.8CVE-2022-37048Broadcom tcpreplay out-of-bounds write vulnerabilityThe component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_l2len_protocol at common/get.c:344. NOTE: …EPSS 0.42%18 Aug 2022 7.8CVE-2022-27416Broadcom tcpreplay double free vulnerabilityTcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free.EPSS 0.84%12 Apr 2022

Source: NIST National Vulnerability Database (record CVE-2025-9385), CISA KEV, FIRST EPSS (scores of 2026-10-06). This page is refreshed as NVD updates the record.