CVE-2025-9386 appneta tcpreplay tcprewrite get.c get_l2len_protocol use after free
A local attacker can exploit a use-after-free flaw in tcprewrite to potentially execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9386?
CVE-2025-9386 is a medium-severity use after free vulnerability in Broadcom Tcpreplay, published on 24 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been found in appneta tcpreplay up to 4.5.1. The impacted element is the function get_l2len_protocol of the file get.c of the component tcprewrite. Such manipulation leads to use after free. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.2-beta3 is sufficient to resolve this issue. You should upgrade the affected component.
Which versions are affected by CVE-2025-9386?
It affects 1 product.
Products include Broadcom Tcpreplay.
How do I fix CVE-2025-9386?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-9386 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-9386 exists.
Other vulnerabilities in Broadcom Tcpreplay
Sources
Also known as DEBIAN-CVE-2025-9386, GHSA-722m-c232-cwqp, UBUNTU-CVE-2025-9386.