What’s Vulnerable › Vulnerabilities

CVE-2025-68276: Avahi has a reachable assertion in avahi_wide_area_scan_cache

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-12 · updated 2026-06-17
• Weakness: CWE-617

Description

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.

Affected products

• avahi: before 0.9; 0.9-rc1 — fixed in 0.9

How to fix

Upgrade to a fixed version: avahi 0.9. Check the vendor advisory for mitigations.

References

• https://github.com/avahi/avahi/commit/ede7048475c5d47d53890e3bc1350dda8e0b3688
• https://github.com/avahi/avahi/pull/806
• https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc

Get alerted when CVE-2025-68276 or the next vulnerability affects your stack