Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2025-2849: UPX up to 5.0.0 allows local memory overflow
CVE-2025-2849 · published 1 year ago
Summary
The UPX compression tool (versions up to 5.0.0) contains a coding error in its Linux ELF handling routine. An attacker who can run code on the same machine could cause the program to write outside its memory space, which could lead to crashes or further exploitation. Install the latest UPX update that includes the fix.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | upx | upx |
<= 5.0.0 cpe:2.3:a:upx:upx:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | upx-ucl | All versions |
Original advisory text
UPX p_lx_elf.cpp un_DT_INIT heap-based overflow
A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of the file src/p_lx_elf.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2. It is recommended to apply a patch to fix this issue.
References
- https://github.com/upx/upx/issues/898 Third Party Advisory
- https://github.com/upx/upx/commit/e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2 Patch
- https://ubuntu.com/security/CVE-2025-2849 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-2849 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2849.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-2849 Vendor Advisory
- https://vuldb.com/?id.301494 Vendor Advisory
- https://vuldb.com/?submit.522371 Vendor Advisory
- https://github.com/upx/upx/issues/898#issuecomment-2734082143 Third Party Advisory
- https://vuldb.com/?ctiid.301494 Third Party Advisory
- https://github.com/user-attachments/files/19307868/input.zip Exploit
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.3
Medium
Type
CWE-119Buffer Overflow
CWE-122Heap-based Buffer Overflow
CWE-787Out-of-bounds Write
Timeline
Published27 Mar 2025
Updated4 Nov 2026
First seen12 Apr 2026
Track software like this
Free during beta