CVE-2025-25568

Published: Mar 12, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function. NOTE: the Supplier disputes this because the use-after-free is not in the VPN software, but is instead in a separate tool that has no untrusted input and runs under the user's own privileges (it is a stress-testing tool for a networking stack).

Affected (1)

Products: Softether: Vpn

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Softether Vpn	Version 5.02.5187

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (3)

https://filecenter.softether-upload.com/d/250715_001_79538/CVE-2025-25568.pdf

Source: cve@mitre.org

https://lzydry.github.io/CVE-2025-25568/

Source: cve@mitre.org

Exploit

https://lzydry.github.io/CVE-2025-25568/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit

Timeline

No history available yet.