CVE-2025-10823: axboe fio options.c str_buffer_pattern_cb null pointer dereference

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-23 · updated 2026-10-11
Weakness: CWE-404

Description

A vulnerability was found in axboe fio up to 3.41. This affects the function str_buffer_pattern_cb of the file options.c. Performing manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used.

Affected products

axboe fio: 3.0, 3.1, 3.2, 3.3, 3.4, 3.5 (+36)

References

https://github.com/axboe/fio/issues/1982
https://github.com/user-attachments/files/22266964/poc.zip
https://vuldb.com/?ctiid.325180
https://vuldb.com/?id.325180
https://vuldb.com/?submit.654069

Get alerted when CVE-2025-10823 or the next vulnerability affects your stack