CVE-2025-34468

HIGH EPSS 46.0%
Published Dec 31, 20256mo ago · Modified Jun 17, 20261w ago
8.2 CVSS 4.0
High
Find Similar
Published Dec 31, 2025 6mo ago
Last Modified Jun 17, 2026 1w ago

Description

libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without proper bounds checking. A remote attacker can trigger a crash and potentially achieve remote code execution depending on compiler options and runtime memory protections. Exploitation requires the proxy logic to be enabled (i.e., the proxy request handling code path in an application using libcoap).

CVSS Details

Base Score
8.2
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
46.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-121
CWE-787 Out-of-bounds Write Memory Safety

Affected Products 1

VendorProductVersionRange
libcoaplibcoap* ≤4.3.5

References 4

  • github.com https://github.com/obgm/libcoap/commit/30db3ea
    Patch
  • github.com https://github.com/obgm/libcoap/pull/1737
    Issue Tracking
  • libcoap.net https://libcoap.net/
    Product
  • vulncheck.com https://www.vulncheck.com/advisories/libcoap-stack-based-buffer-overflow-in-address-resolution-dos-or-potential-rce
    Third Party Advisory

Remediation

  • github.com https://github.com/obgm/libcoap/commit/30db3ea
    Patch