CVE-2025-49604 Memory corruption in n/a
Heap-based buffer overflow in Realtek AmebaD WLAN driver allows attackers to execute code or cause denial of service via fragmented Wi-Fi frames.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-49604?
CVE-2025-49604 is a medium-severity memory corruption vulnerability in n/a, published on 9 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
For Realtek AmebaD devices, a heap-based buffer overflow was discovered in Ameba-AIoT ameba-arduino-d before version 3.1.9 and ameba-rtos-d before commit c2bfd8216a1cbc19ad2ab5f48f372ecea756d67a on 2025/07/03. In the WLAN driver defragment function, lack of validation of the size of fragmented Wi-Fi frames may lead to a heap-based buffer overflow.
Weakness: CWE-122
Which versions are affected by CVE-2025-49604?
How do I fix CVE-2025-49604?
No fix has been published for CVE-2025-49604 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-49604 being exploited?
There is no known exploitation of CVE-2025-49604 in the wild and no public exploit code.
Sources
Also known as GHSA-c4jh-w3h2-9h7c.