{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-7464","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2025-07-11T11:50:08.558Z","datePublished":"2025-07-12T06:32:06.030Z","dateUpdated":"2025-07-14T20:12:39.220Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2025-07-12T06:32:06.030Z"},"title":"osrg GoBGP rtr.go SplitRTR out-of-bounds","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-125","lang":"en","description":"Out-of-Bounds Read"}]},{"descriptions":[{"type":"CWE","cweId":"CWE-119","lang":"en","description":"Memory Corruption"}]}],"affected":[{"vendor":"osrg","product":"GoBGP","versions":[{"version":"3.0","status":"affected"},{"version":"3.1","status":"affected"},{"version":"3.2","status":"affected"},{"version":"3.3","status":"affected"},{"version":"3.4","status":"affected"},{"version":"3.5","status":"affected"},{"version":"3.6","status":"affected"},{"version":"3.7","status":"affected"},{"version":"3.8","status":"affected"},{"version":"3.9","status":"affected"},{"version":"3.10","status":"affected"},{"version":"3.11","status":"affected"},{"version":"3.12","status":"affected"},{"version":"3.13","status":"affected"},{"version":"3.14","status":"affected"},{"version":"3.15","status":"affected"},{"version":"3.16","status":"affected"},{"version":"3.17","status":"affected"},{"version":"3.18","status":"affected"},{"version":"3.19","status":"affected"},{"version":"3.20","status":"affected"},{"version":"3.21","status":"affected"},{"version":"3.22","status":"affected"},{"version":"3.23","status":"affected"},{"version":"3.24","status":"affected"},{"version":"3.25","status":"affected"},{"version":"3.26","status":"affected"},{"version":"3.27","status":"affected"},{"version":"3.28","status":"affected"},{"version":"3.29","status":"affected"},{"version":"3.30","status":"affected"},{"version":"3.31","status":"affected"},{"version":"3.32","status":"affected"},{"version":"3.33","status":"affected"},{"version":"3.34","status":"affected"},{"version":"3.35","status":"affected"},{"version":"3.36","status":"affected"},{"version":"3.37.0","status":"affected"}]}],"descriptions":[{"lang":"en","value":"A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue."},{"lang":"de","value":"Es wurde eine problematische Schwachstelle in osrg GoBGP bis 3.37.0 entdeckt. Hiervon betroffen ist die Funktion SplitRTR der Datei pkg/packet/rtr/rtr.go. Durch das Beeinflussen mit unbekannten Daten kann eine out-of-bounds read-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Die Komplexität eines Angriffs ist eher hoch. Sie gilt als schwierig auszunutzen. Der Patch wird als e748f43496d74946d14fed85c776452e47b99d64 bezeichnet. Als bestmögliche Massnahme wird Patching empfohlen."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.3,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":3.7,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":3.7,"vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":2.6,"vectorString":"AV:N/AC:H/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}],"timeline":[{"time":"2025-07-11T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-07-11T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-07-11T13:55:25.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"CyberGym (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.316116","name":"VDB-316116 | osrg GoBGP rtr.go SplitRTR out-of-bounds","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.316116","name":"VDB-316116 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.610193","name":"Submit #610193 | NTT Open Source GoBGP defe9ac1b1f1c854d1941a5b70dee3aaed6fb960 Out-of-Bounds Read","tags":["third-party-advisory"]},{"url":"https://github.com/osrg/gobgp/commit/e748f43496d74946d14fed85c776452e47b99d64","tags":["patch"]}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-14T19:12:46.250501Z","id":"CVE-2025-7464","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-07-14T20:12:39.220Z"}}]}}