CVE-2025-12899

{"id": "CVE-2025-12899", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2026-01-30T06:16:01.870", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c2vg-hj83-c2vg", "source": "vulnerabilities@zephyrproject.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "A flaw in Zephyr\u2019s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results in an out-of-bounds memory read and creates a potential information-leak vulnerability in the networking subsystem."}, {"lang": "es", "value": "Un fallo en la pila de red de Zephyr permite que un paquete IPv4 que contiene ICMP tipo 128 sea clasificado err\u00f3neamente como una solicitud de eco ICMPv6. Esto resulta en una lectura de memoria fuera de l\u00edmites y crea una potencial vulnerabilidad de fuga de informaci\u00f3n en el subsistema de red."}], "lastModified": "2026-02-04T16:34:21.763", "sourceIdentifier": "vulnerabilities@zephyrproject.org"}