CVE-2025-68615 | net-snmp is a SNMP application library, tools and daemon. Pr… | CVSS 9.8 CRITICAL

Description

net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.

Metadata

CVE ID: CVE-2025-68615
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2025-12-19 14:58 UTC
Published: 2025-12-22 23:55 UTC
Last updated: 2026-05-01 03:55 UTC
Primary CWE: CWE-119
CWE-119: Improper Restriction of Operations within the Bound…
Vendor / Product: net-snmp / net-snmp
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
net-snmp	net-snmp	—	< 5.9.5, >= 5.10.pre1, < 5.10.pre2

Weakness (CWE)

CWE	Source	Description
CWE-119	cna	CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq