Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2025-13654: Zevv DUC disk tool can read beyond memory
CVE-2025-13654 · published 11 months ago
Summary
The DUC program from Zevv can mistakenly read data from the wrong place in memory due to a coding mistake in its buffer_get routine. This could cause the program to crash or behave unpredictably. Update to the latest Zevv DUC version or apply the vendor’s patch to fix the issue.
What to do
- Update debian duc to version 1.4.6-1.
- Update zevv duc to version 1.4.6 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | zevv | duc |
< 1.4.6 cpe:2.3:a:zevv:duc:*:*:*:*:*:*:*:* |
| Debian:12 | debian | duc | All versions |
| Debian:14 | debian | duc |
< 1.4.6-1 Fix: upgrade to 1.4.6-1
|
Original advisory text
CVE-2025-13654
A stack buffer overflow vulnerability exists in the buffer_get function of duc, a disk management tool, where a condition can evaluate to true due to underflow, allowing an out-of-bounds read.
References
- https://github.com/zevv/duc/releases/tag/1.4.6 URL
- https://kb.cert.org/vuls/id/441887 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13654... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-13654 Vendor Advisory
- https://github.com/zevv/duc/commit/8638c4365ffd9e1966bdef8af6339dbee8c17e66 Patch
- https://hackingbydoing.wixsite.com/hackingbydoing/post/stack-buffer-overflow-in-... URL
- https://www.kb.cert.org/vuls/id/441887 URL
- https://security-tracker.debian.org/tracker/CVE-2025-13654 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-787Out-of-bounds Write
Timeline
Published5 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta