PT-2025-52353 · Rofl0R+1 · Proxychains-Ng+1

Vlatko Kosturjak · Published 2025-12-18 · Updated 2026-01-06 · CVE-2025-34451

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rofl0r/proxychains-ng versions up to and including 4.17 and prior to commit cc005b7

Description The software contains a stack-based buffer overflow in the proxy from string() function, located in src/libproxychains.c. This occurs when parsing proxy configuration entries with excessively long username or password fields. The application may write beyond the bounds of stack buffers, potentially causing memory corruption or crashes. This may lead to denial of service and, depending on the environment, could be leveraged for further exploitation.

Recommendations Update to a version after commit cc005b7.

Exploit

Fix

DoS

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2025-34451

Affected Products

Debian

Proxychains-Ng

References · 15

• 🔥 https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-008-proxychains-ng-stack-buffer-overflow-proxy_from_string.md · Exploit
• https://github.com/rofl0r/proxychains-ng/issues/606 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-34451 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-34451 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-34451 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-34451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34451 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34451 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-34451 · Security Note
• https://github.com/httpsgithu/proxychains-ng/commit/cc005b7 · Patch
• https://t.me/cveNotify/147357 · Telegram Post
• https://t.me/CVEtracker/40189 · Telegram Post
• https://twitter.com/CVEnew/status/2002104278823919755 · Twitter Post
• https://vulncheck.com/advisories/rofl0r-proxychains-ng-stack-based-buffer-overflow · Note
• https://twitter.com/threatcluster/status/2008456075637367268 · Twitter Post