CVE-2025-50518

CRITICAL EPSS 33.2%
Published Aug 14, 202510mo ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Aug 14, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

A use-after-free vulnerability exists in the coap_delete_pdu_lkd function within coap_pdu.c of the libcoap library. This issue occurs due to improper handling of memory after the freeing of a PDU object, leading to potential memory corruption or the possibility of executing arbitrary code. NOTE: this is disputed by the Supplier because it only occurs when an application uses libcoap incorrectly.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
33.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

References 4

  • github.com https://github.com/IreneTheITCrowd/blog/blob/main/libcoap-vulnerability.md
  • github.com https://github.com/IreneTheITCrowd/blog/issues/1
  • github.com https://github.com/obgm/libcoap/issues/1724#issuecomment-3199631257
  • github.com https://github.com/obgm/libcoap/issues/1724#issuecomment-3234613482

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.