CVE-2025-64330 Suricata is vulnerable to a heap buffer overflow on verdict
A heap buffer overflow in Suricata can cause crashes when logging verdicts under specific alert queue conditions, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64330?
CVE-2025-64330 is a high-severity memory corruption vulnerability in Oisf Suricata, published on 26 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a single byte read heap overflow when logging the verdict in eve.alert and eve.drop records can lead to crashes. This requires the per packet alert queue to be filled with alerts and then followed by a pass rule. This issue has been patched in versions 7.0.13 and 8.0.2. To reduce the likelihood of this issue occurring, the alert queue size a should be increased (packet-alert-max in suricata.yaml) if verdict is enabled.
Which versions are affected by CVE-2025-64330?
It affects 1 product.
Products include Oisf Suricata.
How do I fix CVE-2025-64330?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-64330 being exploited?
There is no known exploitation of CVE-2025-64330 in the wild and no public exploit code.
Other vulnerabilities in Oisf Suricata
Sources
Also known as DEBIAN-CVE-2025-64330, GHSA-83v7-gm34-f437, UBUNTU-CVE-2025-64330.