PT-2025-28832 · 9Fans · Plan9Port

Jjleo · Published 2025-07-09 · Updated 2026-02-02 · CVE-2025-7209

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: 9fans plan9port versions prior to 9da5b44

Description: A vulnerability exists in the value decode function within the src/libsec/port/x509.c library. The manipulation of this function leads to a null pointer dereference. Local access is required for exploitation. The exploit has been publicly disclosed and may be used.

Recommendations: Apply the patch with identifier deae8939583d83fd798fca97665e0e94656c3ee8 to resolve this issue.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

CVE-2025-7209

Affected Products

Plan9Port

References · 13

• 🔥❌ https://github.com/user-attachments/files/19698361/plan9port_crash_2.txt · Exploit, Deleted
• https://github.com/9fans/plan9port/issues/711#issuecomment-2819905220 · Patch
• https://github.com/9fans/plan9port/issues/711 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-7209 · Vendor Advisory
• https://git.9front.org/plan9front/plan9front/deae8939583d83fd798fca97665e0e94656c3ee8/commit.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-7209 · Security Note
• https://vuldb.com/?id.315157 · Note
• https://vuldb.com/?ctiid.315157 · Note
• https://twitter.com/VulmonFeeds/status/1942826641689911650 · Twitter Post
• https://t.me/cvenotify/128126 · Telegram Post
• https://t.me/cveNotify/150577 · Telegram Post
• https://twitter.com/CVEnew/status/1942924479824536055 · Twitter Post
• https://vuldb.com/?submit.607685 · Note