{"id":"CVE-2025-29364","aliases":["DEBIAN-CVE-2025-29364","EUVD-2025-27740","GHSA-m257-mjqp-xq37","UBUNTU-CVE-2025-29364"],"status":"published","title":"spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and...","description":"spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls. The application verifies the legitimacy of the starting and ending addresses for memory read/write operations. By configuring the starting and ending addresses for memory read/write to point to distinct memory segments within the virtual machine, it is possible to circumvent these checks.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00382,"percentile":0.32632,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-121"],"published":"2025-08-28T00:00:00Z","modified":"2026-10-17T12:56:49Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"spim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0+dfsg-6.1","8.0+dfsg-7","8.0+dfsg-8"]},{"source":"osv","ecosystem":"Debian:13","package":"spim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0+dfsg-7","8.0+dfsg-8"]},{"source":"osv","ecosystem":"Debian:14","package":"spim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0+dfsg-7","8.0+dfsg-8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"spim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0+dfsg-6.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"spim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0+dfsg-6.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"spim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0+dfsg-6.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"spim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0+dfsg-6.1","8.0+dfsg-6.1build1","8.0+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"spim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0+dfsg-7","8.0+dfsg-8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"spim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0+dfsg-8build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"spim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0+dfsg-8","8.0+dfsg-8build1"]}],"products":[{"vendor":"spimsimulator","product":"spim"}],"references":[{"url":"https://github.com/Giles-one/spimsimulatorEscape?tab=readme-ov-file#bug2-bypass-check-in-read_syscall-and-write_syscall-leading-to-out-of-bounds-readwrite","tags":["Exploit","evidence","report"]},{"url":"https://gist.github.com/Giles-one/a398e3da21ea9567970c6f0de543c3b3","tags":["Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29364"},{"url":"https://github.com/advisories/GHSA-m257-mjqp-xq37"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-29364","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-29364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-29364","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-29364","description":"spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls. The application verifies the legitimacy of the starting and ending addresses for memory read/write operations. By configuring the starting and ending addresses for memory read/write to point to distinct memory segments within the virtual machine, it is possible to circumvent these checks.","status":"published","published":"2025-08-28T00:00:00Z","modified":"2025-08-28T20:05:00.602Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:45.797843Z"}],"euvd":[{"id":"EUVD-2025-27740","description":"spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls. The application verifies the legitimacy of the starting and ending addresses for memory read/write operations. By configuring the starting and ending addresses for memory read/write to point to distinct memory segments within the virtual machine, it is possible to circumvent these checks.","status":"published","published":"2025-08-28T00:00:00Z","modified":"2025-08-28T20:05:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:31:50.093994Z"}],"ghsa":[{"id":"GHSA-m257-mjqp-xq37","title":"spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and...","description":"spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls. The application verifies the legitimacy of the starting and ending addresses for memory read/write operations. By configuring the starting and ending addresses for memory read/write to point to distinct memory segments within the virtual machine, it is possible to circumvent these checks.","status":"published","published":"2025-08-28T18:30:38Z","modified":"2025-08-28T21:32:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:03:26.692558Z"}],"nvd":[{"id":"CVE-2025-29364","description":"spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls. The application verifies the legitimacy of the starting and ending addresses for memory read/write operations. By configuring the starting and ending addresses for memory read/write to point to distinct memory segments within the virtual machine, it is possible to circumvent these checks.","status":"published","published":"2025-08-28T16:15:34.643Z","modified":"2026-09-26T00:10:00.127Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:11:25.826804Z"}],"osv":[{"id":"CVE-2025-29364","description":"spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls. The application verifies the legitimacy of the starting and ending addresses for memory read/write operations. By configuring the starting and ending addresses for memory read/write to point to distinct memory segments within the virtual machine, it is possible to circumvent these checks.","status":"published","published":"2025-08-28T16:15:34.643Z","modified":"2026-04-10T05:24:29.543192Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-29364","description":"spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls. The application verifies the legitimacy of the starting and ending addresses for memory read/write operations. By configuring the starting and ending addresses for memory read/write to point to distinct memory segments within the virtual machine, it is possible to circumvent these checks.","status":"published","published":"2025-08-28T16:15:34.643Z","modified":"2026-09-26T08:47:36.097836656Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"UBUNTU-CVE-2025-29364","description":"spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls. The application verifies the legitimacy of the starting and ending addresses for memory read/write operations. By configuring the starting and ending addresses for memory read/write to point to distinct memory segments within the virtual machine, it is possible to circumvent these checks.","status":"published","published":"2025-08-28T16:15:00Z","modified":"2026-10-17T12:56:49.643563065Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"}]}}