CVE-2025-25568 Use after free in n/a
A use-after-free vulnerability in SoftEtherVPN's stress-testing tool could allow code execution or denial of service, though the vendor disputes its security relevance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-25568?
CVE-2025-25568 is a critical use after free vulnerability in n/a, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function. NOTE: the Supplier disputes this because the use-after-free is not in the VPN software, but is instead in a separate tool that has no untrusted input and runs under the user's own privileges (it is a stress-testing tool for a networking stack).
Weakness: CWE-416
Which versions are affected by CVE-2025-25568?
It affects 1 product.
Products include Softether Vpn.
How do I fix CVE-2025-25568?
No fix has been published for CVE-2025-25568 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-25568 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25568 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cr97-553h-m39w.