What’s Vulnerable › Vulnerabilities

CVE-2025-32801: Loading a malicious hook library can lead to local privilege escalation

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-28 · updated 2026-06-17
• Weakness: CWE-94

Description

Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Affected products

• ISC Kea: from 2.4.0 through 2.4.1; from 2.6.0 through 2.6.2; from 2.7.0 through 2.7.8

References

• https://kb.isc.org/docs/cve-2025-32801

Get alerted when CVE-2025-32801 or the next vulnerability affects your stack