CVE-2025-57275

SPDK is vulnerable to buffer overflow in the NVMe-oF target component

5.5 MediumFix available

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: High

Exploit likelihood

0.33%Up 0.3 points since Oct 2, 2025

What each source reports

CVE List Score used 5.5

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.

Record: CVE-2025-57275
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-120
Updated: 2026-11-02

EUVDEUVD-2025-32707 5.5

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.

Record: EUVD-2025-32707
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5m5w-w2h2-fqgq 5.5

SPDK is vulnerable to buffer overflow in the NVMe-oF target component

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.

Record: GHSA-5m5w-w2h2-fqgq
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-119, CWE-120
Updated: 2026-11-02

NVD 5.5

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.

Record: CVE-2025-57275
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-120
Updated: 2026-11-06

OSV 5.5

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.

Record: CVE-2025-57275
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-07

OSVGHSA-5m5w-w2h2-fqgq 5.5

SPDK is vulnerable to buffer overflow in the NVMe-oF target component

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.

Record: GHSA-5m5w-w2h2-fqgq
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-119, CWE-120
Updated: 2026-11-02

Show 6 moreShow less

OSVOESA-2025-2523 5.5

spdk security update

The Storage Performance Development Kit provides a set of tools and libraries for writing high performance, scalable, user-mode storage applications.

Security Fix(es):

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.(CVE-2025-57275)

Record: OESA-2025-2523
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVOESA-2025-2524 5.5

spdk security update

The Storage Performance Development Kit provides a set of tools and libraries for writing high performance, scalable, user-mode storage applications.

Security Fix(es):

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.(CVE-2025-57275)

Record: OESA-2025-2524
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVOESA-2025-2525 5.5

spdk security update

The Storage Performance Development Kit provides a set of tools and libraries for writing high performance, scalable, user-mode storage applications.

Security Fix(es):

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.(CVE-2025-57275)

Record: OESA-2025-2525
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVOESA-2025-2692 5.5

spdk security update

The Storage Performance Development Kit provides a set of tools and libraries for writing high performance, scalable, user-mode storage applications.

Security Fix(es):

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.(CVE-2025-57275)

Record: OESA-2025-2692
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVOESA-2025-2693 5.5

spdk security update

The Storage Performance Development Kit provides a set of tools and libraries for writing high performance, scalable, user-mode storage applications.

Security Fix(es):

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.(CVE-2025-57275)

Record: OESA-2025-2693
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVPYSEC-2026-1935 5.5

SPDK is vulnerable to buffer overflow in the NVMe-oF target component

Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.

Record: PYSEC-2026-1935
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`spdk` PyPI	before 25.9	25.9
`spdk` PyPI	before 25.9, plus listed versions 25.525.5.1	25.9
`spdk` openEuler:24.03-LTS	before 24.01-10.oe2403	24.01-10.oe2403
`spdk` openEuler:24.03-LTS-SP1	before 24.01-11.oe2403sp1	24.01-11.oe2403sp1
`spdk` openEuler:20.03-LTS-SP4	before 21.01-11.oe2003sp4	21.01-11.oe2003sp4
`spdk` openEuler:22.03-LTS-SP3	before 21.01.1-16.oe2203sp3	21.01.1-16.oe2203sp3
`spdk` openEuler:22.03-LTS-SP4	before 21.01.1-18.oe2203sp4	21.01.1-18.oe2203sp4

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts	NVD
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-57275 is a medium vulnerability (CVSS 5.5) in spdk, published October 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in spdk 25.9.

References

Show 7 moreShow less