{"id":"CVE-2025-7464","summary":"osrg GoBGP rtr.go SplitRTR out-of-bounds","details":"A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue.","modified":"2026-10-28T02:30:53.747098616Z","published":"2025-07-12T06:32:06.030Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-119","CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7464.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7464.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7464"},{"type":"ADVISORY","url":"https://vuldb.com/?id.316116"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.610193"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.316116"},{"type":"FIX","url":"https://github.com/osrg/gobgp/commit/e748f43496d74946d14fed85c776452e47b99d64"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/osrg/gobgp","events":[{"introduced":"ba6971fecdf644d2baeb219b85d8693a28b20a78"},{"fixed":"e748f43496d74946d14fed85c776452e47b99d64"}],"database_specific":{"extracted_events":[{"strategy":"StandaloneSingleVersion","range":[{"introduced":"3.0"},{"last_affected":"3.0"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.1"},{"last_affected":"3.1"}]},{"range":[{"introduced":"3.2"},{"last_affected":"3.2"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"3.3"},{"last_affected":"3.3"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"3.4"},{"last_affected":"3.4"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"3.5"},{"last_affected":"3.5"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"3.6"},{"last_affected":"3.6"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"3.7"},{"last_affected":"3.7"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.8"},{"last_affected":"3.8"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.9"},{"last_affected":"3.9"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"3.10"},{"last_affected":"3.10"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.11"},{"last_affected":"3.11"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"3.12"},{"last_affected":"3.12"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"3.13"},{"last_affected":"3.13"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"3.14"},{"last_affected":"3.14"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.15"},{"last_affected":"3.15"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"3.16"},{"last_affected":"3.16"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"3.17"},{"last_affected":"3.17"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.18"},{"last_affected":"3.18"}]},{"range":[{"introduced":"3.19"},{"last_affected":"3.19"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"3.20"},{"last_affected":"3.20"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.21"},{"last_affected":"3.21"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"3.22"},{"last_affected":"3.22"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"3.23"},{"last_affected":"3.23"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"3.24"},{"last_affected":"3.24"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"3.25"},{"last_affected":"3.25"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.26"},{"last_affected":"3.26"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.27"},{"last_affected":"3.27"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.28"},{"last_affected":"3.28"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.29"},{"last_affected":"3.29"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.30"},{"last_affected":"3.30"}]},{"range":[{"introduced":"3.31"},{"last_affected":"3.31"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"3.32"},{"last_affected":"3.32"}]},{"range":[{"introduced":"3.33"},{"last_affected":"3.33"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"3.34"},{"last_affected":"3.34"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"3.35"},{"last_affected":"3.35"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"3.36"},{"last_affected":"3.36"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"3.37.0"},{"last_affected":"3.37.0"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"e748f43496d74946d14fed85c776452e47b99d64"}]}]}}],"versions":["3.0","3.1","3.10","3.11","3.12","3.13","3.14","3.15","3.16","3.17","3.18","3.19","3.2","3.20","3.21","3.22","3.23","3.24","3.25","3.26","3.27","3.28","3.29","3.3","3.30","3.31","3.32","3.33","3.34","3.35","3.36","3.37.0","3.4","3.5","3.6","3.7","3.8","3.9","v3.37.0","v3.36.0","v3.35.0","v3.34.0","v3.33.0","v3.32.0","v3.31.0","v3.30.0","v3.29.0","v3.28.0","v3.27.0","v3.26.0","v3.25.0","v3.24.0","v3.23.0","v3.22.0","v3.21.0","v3.20.0","v3.19.0","v3.17.0","v3.16.0","v3.15.0","v3.14.0","v3.13.0","v3.12.0","v3.11.0","v3.10.0","v3.9.0","v3.8.0","v3.7.0","v3.6.0","v3.5.0","v3.4.0","v3.3.0","v3.2.0","v3.1.0","v3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7464.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}]}