CVE-2025-64330 - CVE House

Back to Database

Status published High CVE-2025-64330

Suricata is vulnerable to a heap buffer overflow on verdict

7.5 CVSS

Vulnerability Description

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a single byte read heap overflow when logging the verdict in eve.alert and eve.drop records can lead to crashes. This requires the per packet alert queue to be filled with alerts and then followed by a pass rule. This issue has been patched in versions 7.0.13 and 8.0.2. To reduce the likelihood of this issue occurring, the alert queue size a should be increased (packet-alert-max in suricata.yaml) if verdict is enabled.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64330

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OISF

View All →

Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBuffer

Suricata is vulnerable to a null deref when used with base64_data

Suricata is vulnerable to unbounded memory growth for decompression

Suricata is vulnerable to a stack overflow from big content-type

Suricata is vulnerable to a stack overflow on larger compressed data

Affected Vendor

OISF

View all reports →

Affected Software

suricata

Vulnerable Versions:

< 7.0.13, < 8.0.2

Timeline

Official Publish: November 26th, 2025

Last Modified: November 28th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion