Cve 2025 25566

Summary

SoftEtherVPN 5.02.5187 is vulnerble to denial of service via the UnixMemoryAlloc function.

To exploit this vulnerability, an attacker must utilize the vpncmd binary file and supply 136 bytes of input to circumvent the main menu and be presented with the VPN Tools menu. After inputting quit, the program will cause a direct leak of 576 bytes.

Details

The memory leak exists at line 2177 of the UnixMemoryAlloc function within SoftEtherVPN/src/Mayaqua/Unix.c. The function allocated 576 bytes, but there was no corresponding de-allocation for these bytes.

void *UnixMemoryAlloc(UINT size)
{
	void *r;
	pthread_mutex_lock(&malloc_lock);
	r = malloc(size);
	pthread_mutex_unlock(&malloc_lock);
	return r;
}