What’s Vulnerable › Vulnerabilities
CVE-2025-37178: Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-01-13 · updated 2026-06-17
- Weakness: CWE-125
Description
Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process.
Affected products
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS): from 8.6.0.0 before 8.10.0.21; from 8.11.0.0 before 8.13.1.1 — fixed in 8.10.0.21, 8.13.1.1
How to fix
Upgrade to a fixed version: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) 8.10.0.21, 8.13.1.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-37178 or the next vulnerability affects your stack