CVE-2025-50518

A use-after-free vulnerability exists in the coap_delete_pdu_lkd function within coap_pdu.c of the libcoap library

Critical · published August 14, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

🔥 A use-after-free vulnerability lurking in the libcoap library could lead to memory corruption or even arbitrary code execution! Think of this like a restaurant that serves a dish with an ingredient that was supposed to be thrown out—improper handling can lead to a surprise that no one wants! When the chef frees up space in the pantry too soon, the next order might end with a nasty surprise on the plate. An attacker could exploit this flaw to manipulate memory in unexpected ways, potentially executing malicious code within the application. This could result in devastating consequences, such as unauthorized access to sensitive data or full control over the affected system. The severity of this vulnerability cannot be overstated, making it critical to address immediately!

Put simply

Think of this like a restaurant that serves a dish with an ingredient that was supposed to be thrown out—improper handling can lead to a surprise that no one wants! When the chef frees up space in the pantry too soon, the next order might end with a nasty surprise on the plate. The vulnerability arises in the coap_delete_pdu_lkd function of the libcoap library, where improper memory management after freeing a PDU object can lead to memory corruption. This issue primarily occurs when libcoap is used incorrectly by applications, potentially allowing for arbitrary code execution.

What to do

An attacker could exploit this flaw to manipulate memory in unexpected ways, potentially executing malicious code within the application. This could result in devastating consequences, such as unauthorized access to sensitive data or full control over the affected system. The severity of this vulnerability cannot be overstated, making it critical to address immediately! To mitigate this vulnerability, ensure that your application utilizes the libcoap library correctly to avoid misuse of its functions. Regularly update to the latest version of libcoap to incorporate any security fixes and improvements. Conduct a thorough code review to identify any potential areas where incorrect handling might occur. You've got this! Follow these steps and you can lock down your application like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.2th percentile
Published
2025-08-14T00:00Z
EPSS history
Timeline
  • 14 AUG 00:00Z
    A use-after-free vulnerability exists in the coap_delete_pdu_lkd function within coap_pdu.c of the libcoap library
    cvelistv5