CVE-2025-61553

An out-of-bounds write in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20) to commit 480907 (2025-07-06) allows local attackers to…

High · published October 16, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
10.7
In the wild
Unconfirmed
What it is

⚡ An out-of-bounds write in BitVisor's VirtIO network device emulation can lead to mind-blowing chaos! 🚨 Think of it like a guest at a hotel who somehow sneaks into the staff-only area and starts rearranging furniture — the whole operation can come crashing down if they knock over something important! An attacker with local access could trigger a denial of service, causing the host hypervisor to crash. This might allow them to execute arbitrary code or escalate privileges from a guest to the host, leading to a full-blown system takeover. Absolutely devastating!

Put simply

Think of it like a guest at a hotel who somehow sneaks into the staff-only area and starts rearranging furniture — the whole operation can come crashing down if they knock over something important! This vulnerability arises from a heap overflow during a PCI configuration space access, placing it in a privileged hypervisor context. A crafted access can exploit this flaw, resulting in severe consequences for system stability and security.

What to do

An attacker with local access could trigger a denial of service, causing the host hypervisor to crash. This might allow them to execute arbitrary code or escalate privileges from a guest to the host, leading to a full-blown system takeover. Absolutely devastating! Update BitVisor to a patched version after July 6, 2025, to eliminate this vulnerability. Ensure that access controls are strictly monitored and consider implementing additional security measures to limit local access to the hypervisor. 🛡️ You've got this! With the right steps, you can secure your system and keep the chaos at bay! 💪✨

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.7th percentile
Published
2025-10-16T00:00Z
EPSS history
Timeline
  • 16 OCT 00:00Z
    An out-of-bounds write in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20) to commit 480907 (2025-07-06) allows local attackers to…
    cvelistv5