Search for vulnerabilities
Vulnerability details: VCID-7wgk-rep9-pyh1
Vulnerability ID VCID-7wgk-rep9-pyh1
Aliases CVE-2025-54409
Summary AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.
Status Published
Exploitability 0.5
Weighted Severity 5.6
Risk 2.8
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-476 NULL Pointer Dereference
System Score Found at
cvssv3 5.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-54409.json
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2025-54409
cvssv3.1 6.2 https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a
ssvc Track https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a
cvssv3.1 6.2 https://github.com/aide/aide/releases/tag/v0.19.2
ssvc Track https://github.com/aide/aide/releases/tag/v0.19.2
cvssv3.1 6.2 https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh
ssvc Track https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-54409.json
https://api.first.org/data/v1/epss?cve=CVE-2025-54409
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54409
2388018 https://bugzilla.redhat.com/show_bug.cgi?id=2388018
54a6d0d9d5f14b81961d66373c0291bf4af4135a https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a
CVE-2025-54409 https://nvd.nist.gov/vuln/detail/CVE-2025-54409
GHSA-79g7-f8rv-jcxh https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh
USN-7697-1 https://usn.ubuntu.com/7697-1/
v0.19.2 https://github.com/aide/aide/releases/tag/v0.19.2
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-54409.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-14T18:43:34Z/ Found at https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/aide/aide/releases/tag/v0.19.2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-14T18:43:34Z/ Found at https://github.com/aide/aide/releases/tag/v0.19.2
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-14T18:43:34Z/ Found at https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh
Exploit Prediction Scoring System (EPSS)
Percentile 0.01125
EPSS Score 0.00012
Published At Aug. 15, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-08-15T09:15:18.175990+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/54xxx/CVE-2025-54409.json 37.0.0