CVE-2025-49809
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by...
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
- Record
CVE-2025-49809- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-829
- Updated
- 2026-11-02
EUVDEUVD-2025-20020
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
- Record
EUVD-2025-20020- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hvvx-vw37-6fjm
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by...
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
- Record
GHSA-hvvx-vw37-6fjm- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-829
- Updated
- 2026-11-02
NVD
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
- Record
CVE-2025-49809- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-829
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-49809
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
- Record
ALPINE-CVE-2025-49809- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
- Record
CVE-2025-49809- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-829
- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2025-49809
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
- Record
DEBIAN-CVE-2025-49809- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-49809
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
- Record
UBUNTU-CVE-2025-49809- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-65136 No score
CVE-2025-49809 affecting package mtr 0.95-1
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
- Record
AZL-65136- Updated
- 2026-11-02
OSVAZL-65232 No score
CVE-2025-49809 affecting package mtr for versions less than 0.95-3
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
- Record
AZL-65232- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mtrAlpine:v3.22 |
before 0.96-r0 | 0.96-r0 |
mtrAlpine:v3.23 |
before 0.96-r0 | 0.96-r0 |
mtrAlpine:v3.24 |
before 0.96-r0 | 0.96-r0 |
mtrAzure Linux:2 |
through 0.95-1 | None known |
mtrAzure Linux:3 |
before 0.95-3 | 0.95-3 |
mtrDebian:12 |
All versions, plus listed versions 0.95-10.95-1.10.96-10.96-1~bpo13+10.96-2 |
None known |
mtrDebian:13 |
All versions, plus listed versions 0.95-1.10.96-10.96-1~bpo13+10.96-2 |
None known |
mtrDebian:14 |
before 0.96-1, plus listed versions 0.95-1.10.96-1~bpo13+1 |
0.96-1 |
mtrUbuntu:14.04:LTS |
All versions, plus listed versions 0.85-10.85-2 |
None known |
mtrUbuntu:16.04:LTS |
All versions, plus listed versions 0.85-30.86-10.86-1ubuntu0.1 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mtrUbuntu:18.04:LTS |
All versions, plus listed versions 0.87-10.92-1 |
None known |
mtrUbuntu:20.04:LTS |
All versions, plus listed versions 0.93-1 |
None known |
mtrUbuntu:22.04:LTS |
All versions, plus listed versions 0.94-1build10.94-2ubuntu10.95-1 |
None known |
mtrUbuntu:24.04:LTS |
All versions, plus listed versions 0.95-10.95-1.10.95-1.1build10.95-1.1build20.95-1.1ubuntu0.1 |
None known |
mtrUbuntu:25.10 |
All versions, plus listed versions 0.95-1.1ubuntu1 |
None known |
mtrUbuntu:26.04:LTS |
All versions, plus listed versions 0.95-1.1ubuntu10.95-1.1ubuntu2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49809 is a high vulnerability (CVSS 7.8) in Mtr, published July 4, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in mtr 0.96-r0.