Every CVE Search/ Get API key

CVE-2025-54409

AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)

6.2 MediumFix available

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.26%Up 0.2 points since Aug 15, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.2

AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Record
CVE-2025-54409
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2025-24863 6.2

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Record
EUVD-2025-24863
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
NVD 6.2

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Record
CVE-2025-54409
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSV 6.2

AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Record
CVE-2025-54409
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVDEBIAN-CVE-2025-54409 5.5

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Record
DEBIAN-CVE-2025-54409
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2108 6.2

aide security update

Security Fix(es):

A vulnerability was found in AIDE up to 0.19.1 and classified as problematic.Using CWE to declare the problem leads to CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.Impacted is integrity.Upgrading to version 0.19.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 64c8f32b0349c33fb8382784af468338078851f9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54389)

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.(CVE-2025-54409)

Record
OESA-2025-2108
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 13 moreShow less
OSVOESA-2025-2109 6.2

aide security update

Security Fix(es):

A vulnerability was found in AIDE up to 0.19.1 and classified as problematic.Using CWE to declare the problem leads to CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.Impacted is integrity.Upgrading to version 0.19.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 64c8f32b0349c33fb8382784af468338078851f9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54389)

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.(CVE-2025-54409)

Record
OESA-2025-2109
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2110 6.2

aide security update

Security Fix(es):

A vulnerability was found in AIDE up to 0.19.1 and classified as problematic.Using CWE to declare the problem leads to CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.Impacted is integrity.Upgrading to version 0.19.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 64c8f32b0349c33fb8382784af468338078851f9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54389)

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.(CVE-2025-54409)

Record
OESA-2025-2110
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2111 6.2

aide security update

Security Fix(es):

A vulnerability was found in AIDE up to 0.19.1 and classified as problematic.Using CWE to declare the problem leads to CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.Impacted is integrity.Upgrading to version 0.19.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 64c8f32b0349c33fb8382784af468338078851f9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54389)

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.(CVE-2025-54409)

Record
OESA-2025-2111
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2112 6.2

aide security update

Security Fix(es):

A vulnerability was found in AIDE up to 0.19.1 and classified as problematic.Using CWE to declare the problem leads to CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.Impacted is integrity.Upgrading to version 0.19.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 64c8f32b0349c33fb8382784af468338078851f9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54389)

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.(CVE-2025-54409)

Record
OESA-2025-2112
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2262 6.2

aide security update

Security Fix(es):

A vulnerability was found in AIDE up to 0.19.1 and classified as problematic.Using CWE to declare the problem leads to CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.Impacted is integrity.Upgrading to version 0.19.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 64c8f32b0349c33fb8382784af468338078851f9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54389)

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.(CVE-2025-54409)

Record
OESA-2025-2262
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-54409 6.2

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Record
UBUNTU-CVE-2025-54409
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-66429 No score

CVE-2025-54409 affecting package aide for versions less than 0.18.6-2

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Record
AZL-66429
Updated
2026-11-05
OSVAZL-66431 No score

CVE-2025-54409 affecting package aide for versions less than 0.16-17

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Record
AZL-66431
Updated
2026-11-02
OSVMGASA-2025-0224 No score

Updated aide packages fix vulnerabilities

Improper output neutralization (potential AIDE detection bypass). (CVE-2025-54389) Null pointer dereference after reading incorrectly encoded xattr attributes from database (local DoS). (CVE-2025-54409)

Record
MGASA-2025-0224
Updated
2026-11-02
OSVopenSUSE-SU-2025:15474-1 No score

aide-0.19.2-1.1 on GA media

These are all security issues fixed in the aide-0.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15474-1
Updated
2026-11-02
OSVSUSE-SU-2025:20657-1 No score

Security update for aide

This update for aide fixes the following issues:

  • CVE-2025-54389: Escape control characters in report and log output (bsc#1247884).
  • CVE-2025-54409: Fix null pointer dereference after reading incorrectly encoded xattr attributes from database (bsc#1247885).
Record
SUSE-SU-2025:20657-1
Updated
2026-11-02
OSVSUSE-SU-2025:20754-1 No score

Security update for aide

This update for aide fixes the following issues:

  • CVE-2025-54389: Fixed improper output neutralization (bsc#1247884)
  • CVE-2025-54409: Fixed null pointer dereference after reading incorrectly encoded xattr attributes from database (bsc#1247885)
Record
SUSE-SU-2025:20754-1
Updated
2026-11-02
OSVUSN-7697-1 No score

aide vulnerabilities

Rajesh Pangare discovered that AIDE incorrectly handled filenames. A local attacker could possibly use this issue to bypass the detection of malicious files. (CVE-2025-54389)

Rajesh Pangare discovered that AIDE incorrectly handled extended file attributes. A local attacker could possibly use this issue to cause a denial of service. (CVE-2025-54409)

Record
USN-7697-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aide
Azure Linux:3
 before 0.18.6-2
0.18.6-2
aide
Azure Linux:2
 before 0.16-17
0.16-17
aide
Debian:12
 before 0.18.3-1+deb12u4, plus listed versions
0.18.3-10.18.3-1+deb12u10.18.3-1+deb12u20.18.3-1+deb12u3
0.18.3-1+deb12u4
aide
Debian:13
 before 0.19.1-2+deb13u1, plus listed versions
0.19.1-2
0.19.1-2+deb13u1
aide
Debian:14
 before 0.19.2-1, plus listed versions
0.19.1-2
0.19.2-1
aide
Debian:11
From an advisory covering 2 CVEs
 before 0.17.3-4+deb11u3, plus listed versions
0.17.3-40.17.3-4+deb11u10.17.3-4+deb11u2
0.17.3-4+deb11u3
aide
Debian:12
From an advisory covering 2 CVEs
 before 0.18.3-1+deb12u4, plus listed versions
0.18.3-10.18.3-1+deb12u10.18.3-1+deb12u20.18.3-1+deb12u3
0.18.3-1+deb12u4
aide
Debian:13
From an advisory covering 2 CVEs
 before 0.19.1-2+deb13u1, plus listed versions
0.19.1-2
0.19.1-2+deb13u1
aide
Mageia:9
From an advisory covering 2 CVEs
 before 0.18.6-1.1.mga9
0.18.6-1.1.mga9
aide
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 0.17.4-8.oe2203sp4
0.17.4-8.oe2203sp4
Show 20 moreShow less
Affected packages
PackageAffectedFixed
aide
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 0.18.6-7.oe2403sp1
0.18.6-7.oe2403sp1
aide
openEuler:24.03-LTS-SP2
From an advisory covering 2 CVEs
 before 0.18.6-7.oe2403sp2
0.18.6-7.oe2403sp2
aide
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 0.16.2-8.oe2003sp4
0.16.2-8.oe2003sp4
aide
openEuler:22.03-LTS-SP3
From an advisory covering 2 CVEs
 before 0.17.4-8.oe2203sp3
0.17.4-8.oe2203sp3
aide
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 0.18.6-7.oe2403
0.18.6-7.oe2403
aide
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 0.18.6-2.1
0.18.6-2.1
aide
SUSE:Linux Micro 6.1
From an advisory covering 2 CVEs
 before 0.18.6-slfo.1.1_2.1
0.18.6-slfo.1.1_2.1
aide
Ubuntu:Pro:14.04:LTS
 before 0.16~a2.git20130520-2ubuntu0.1+esm2, plus listed versions
0.15.1-8ubuntu20.16~a2.git20130520-20.16~a2.git20130520-2ubuntu0.10.16~a2.git20130520-2ubuntu0.1+esm1
0.16~a2.git20130520-2ubuntu0.1+esm2
aide
Ubuntu:Pro:16.04:LTS
 before 0.16~a2.git20130520-3ubuntu0.1~esm2, plus listed versions
0.16~a2.git20130520-30.16~a2.git20130520-3ubuntu0.1~esm1
0.16~a2.git20130520-3ubuntu0.1~esm2
aide
Ubuntu:Pro:18.04:LTS
 before 0.16-3ubuntu0.1+esm1, plus listed versions
0.16-10.16-20.16-30.16-3ubuntu0.1
0.16-3ubuntu0.1+esm1
aide
Ubuntu:Pro:20.04:LTS
 before 0.16.1-1ubuntu0.1+esm1, plus listed versions
0.16.1-1build20.16.1-1ubuntu0.1
0.16.1-1ubuntu0.1+esm1
aide
Ubuntu:22.04:LTS
 before 0.17.4-1ubuntu0.2, plus listed versions
0.17.3-4build10.17.3-50.17.4-10.17.4-1ubuntu0.1
0.17.4-1ubuntu0.2
aide
Ubuntu:24.04:LTS
 before 0.18.6-2ubuntu0.1, plus listed versions
0.18.5-10.18.6-20.18.6-2build10.18.6-2build2
0.18.6-2ubuntu0.1
aide
Ubuntu:Pro:14.04:LTS
From an advisory covering 2 CVEs
 before 0.16~a2.git20130520-2ubuntu0.1+esm2, plus listed versions
0.15.1-8ubuntu20.16~a2.git20130520-20.16~a2.git20130520-2ubuntu0.10.16~a2.git20130520-2ubuntu0.1+esm1
0.16~a2.git20130520-2ubuntu0.1+esm2
aide
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 0.16~a2.git20130520-3ubuntu0.1~esm2, plus listed versions
0.16~a2.git20130520-30.16~a2.git20130520-3ubuntu0.1~esm1
0.16~a2.git20130520-3ubuntu0.1~esm2
aide
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
 before 0.16-3ubuntu0.1+esm1, plus listed versions
0.16-10.16-20.16-30.16-3ubuntu0.1
0.16-3ubuntu0.1+esm1
aide
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
 before 0.16.1-1ubuntu0.1+esm1, plus listed versions
0.16.1-1build20.16.1-1ubuntu0.1
0.16.1-1ubuntu0.1+esm1
aide
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 0.17.4-1ubuntu0.2, plus listed versions
0.17.3-4build10.17.3-50.17.4-10.17.4-1ubuntu0.1
0.17.4-1ubuntu0.2
aide
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 0.18.6-2ubuntu0.1, plus listed versions
0.18.5-10.18.6-20.18.6-2build10.18.6-2build2
0.18.6-2ubuntu0.1
aide
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 0.19.2-1.1
0.19.2-1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-54409 is a medium vulnerability (CVSS 6.2) in Advanced Intrusion Detection Environment Project Intrusion Detection Environment, published August 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in aide 0.18.6-2.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open