Buffer overflow in Red Hat Enterprise Linux 10

CVE-2025-12464

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.

Vulnerability class: Buffer Overflow

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.002 (5.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 5.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-12464: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2025-12464?
CVE-2025-12464 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, classified under Stack-based Buffer Overflow. CVSS score: 6.2/10. Published 2025-10-31.
How severe is CVE-2025-12464?
Medium severity. CVSS v3 base score is 6.2 out of 10.