CVE-2025-32022
Finit has heap based buffer overwrite in urandom.so plugin
Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the configure script.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Finit has heap based buffer overwrite in urandom.so plugin
Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the configure script.
- Record
CVE-2025-32022- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2025-14717
Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the configure script.
- Record
EUVD-2025-14717- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L - Updated
- 2026-11-02
NVD
Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the configure script.
- Record
CVE-2025-32022- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Finit has heap based buffer overwrite in urandom.so plugin
Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the configure script.
- Record
CVE-2025-32022- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-32022
Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the configure script.
- Record
DEBIAN-CVE-2025-32022- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-32022
Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the configure script.
- Record
UBUNTU-CVE-2025-32022- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
finitDebian:12 |
All versions, plus listed versions 4.11-14.12-14.14-14.2-14.7-14.7-24.7-3 |
None known |
finitDebian:13 |
before 4.12-1 | 4.12-1 |
finitDebian:14 |
before 4.12-1 | 4.12-1 |
finitUbuntu:22.04:LTS |
All versions, plus listed versions 4.1-14.2-1 |
None known |
finitUbuntu:24.04:LTS |
All versions, plus listed versions 4.2-14.7-14.7-1build14.7-1build2 |
None known |
finitUbuntu:25.10 |
All versions, plus listed versions 4.7-34.11-14.12-1 |
None known |
finitUbuntu:26.10 |
All versions, plus listed versions 4.14-1 |
None known |
finitUbuntu:26.04:LTS |
All versions, plus listed versions 4.12-14.14-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-32022 is a medium vulnerability (CVSS 4.6) in Troglobit Finit, published May 6, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 3rd percentile. Fixed in finit 4.12-1.
References
github.com/troglobit/finit/security/advisories/GHSA-fv6v-vw8h-9x79
nvd.nist.gov/vuln/detail/CVE-2025-32022
security-tracker.debian.org/tracker/CVE-2025-32022
ubuntu.com/security/CVE-2025-32022
cve.org/CVERecord?id=CVE-2025-32022