Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2025-11010: libucl 0.9.2 may overflow memory when including files
CVE-2025-11010 · published 1 year ago
Summary
The libucl library (version 0.9.2 and earlier) can write past the end of a memory area when processing certain include commands. An attacker with local access could cause the program to crash or potentially take control of it. Update to a newer libucl version or apply the vendor’s patch to stop the issue.
Original advisory text
vstakhov libucl ucl_util.c ucl_include_common heap-based overflow
A vulnerability has been found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_include_common of the file /src/ucl_util.c. Such manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11010... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-11010 Vendor Advisory
- https://github.com/vstakhov/libucl/issues/337 Third Party Advisory
- https://github.com/user-attachments/files/22317650/poc.zip Exploit
- https://vuldb.com/?id.325953 Vendor Advisory
- https://vuldb.com/?submit.654068 Vendor Advisory
- https://vuldb.com/?ctiid.325953 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.9
Medium
Type
CWE-119Buffer Overflow
CWE-122Heap-based Buffer Overflow
Timeline
Published26 Sep 2025
Updated26 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta