CVE-2025-72089fans plan9port x509.c edump heap-based overflow
- 5.1MediumCVSS base score
- 0.62%Exploitation in 30 daysEPSS · top 50% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- YesPublic exploitsa reference or SSVC says so
Description
A vulnerability was found in 9fans plan9port up to 9da5b44. It has been classified as critical. This affects the function edump in the library /src/plan9port/src/libsec/port/x509.c. The manipulation leads to heap-based buffer overflow. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is b3e06559475b0130a7a2fb56ac4d131d13d2012f. It is recommended to apply a patch to fix this issue.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. A reference of the record is tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.
Show the exploits1
References tagged exploit1 reference
Timeline
ID reserved
By VulDB
- 2 days later
· 2 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulDBCNA (assigner) | 4.0 | Medium5.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| VulDBCNA (assigner) | 3.1 | Medium5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| VulDBCNA (assigner) | 3.0 | Medium5.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| VulDBCNA (assigner) | 2.0 | Medium5.2 | AV:A/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C |
| NVDNVD · Analyzed | 4.0 | Low2.0 | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.62% · top 50% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.
Affected products
References
References8
- VDB-259053 | 9fans plan9port x509.c edump heap-based overflow (opens in a new tab)vdb-entrytechnical-description
- VDB-259053 | CTI Indicators (IOB, IOC, IOA) (opens in a new tab)signaturepermissions-required
- Submit #304567 | plan9port plan9port commit be7c68f6954f7dcaa53403e0f600716f65a13d32 heap-buffer-overflow (opens in a new tab)third-party-advisory
- Submit #607684 | 9fans plan9port plan9port-20250329 (commit 9da5b44) Heap-based Buffer Overflow (Duplicate) (opens in a new tab)third-party-advisory
- https://drive.google.com/drive/folders/1kedwNLNDiFQB2OAp7S-ZKYoF7nxfIZGO?usp=sharing (opens in a new tab)related
- https://github.com/9fans/plan9port/issues/710#issuecomment-2819906648 (opens in a new tab)issue-tracking
- https://github.com/user-attachments/files/19698345/plan9port_crash_1.txt (opens in a new tab)exploit
- https://git.9front.org/plan9front/plan9front/b3e06559475b0130a7a2fb56ac4d131d13d2012f/commit.html (opens in a new tab)patch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-20766 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-7208)Record last updated .