CVE-2025-9385 appneta tcpreplay tcprewrite edit_packet.c fix_ipv6_checksums use after free
A local attacker can exploit a use-after-free flaw in tcprewrite to potentially execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9385?
CVE-2025-9385 is a medium-severity use after free vulnerability in Broadcom Tcpreplay, published on 24 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw has been found in appneta tcpreplay up to 4.5.1. The affected element is the function fix_ipv6_checksums of the file edit_packet.c of the component tcprewrite. This manipulation causes use after free. The attack is restricted to local execution. The exploit has been published and may be used. Upgrading to version 4.5.2-beta3 is sufficient to fix this issue. It is advisable to upgrade the affected component.
Which versions are affected by CVE-2025-9385?
It affects 1 product.
Products include Broadcom Tcpreplay.
How do I fix CVE-2025-9385?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-9385 being exploited?
There is no known exploitation of CVE-2025-9385 in the wild and no public exploit code.
Other vulnerabilities in Broadcom Tcpreplay
Sources
Also known as DEBIAN-CVE-2025-9385, GHSA-h762-gwwm-v9vj, UBUNTU-CVE-2025-9385.