CVE catalog

CVE-2025-60458

uxplay: CVE-2025-60458

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.31% · Oct 25, 2026

UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially crafted RTSP TEARDOWN request can trigger multiple calls to free() on the same memory address, potentially causing a Denial of Service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianuxplaysid1.73.7-1fixed
Debianuxplayforky1.73.7-1fixed
Debianuxplaytrixie1.71.1-1vulnerable
Debianuxplaybookworm1.62-1vulnerable
CpeuxplayNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianuxplaysourcesid1.72.3-1not yet assignedNot reported[1124380]
Debianuxplaysourceforky1.72.3-1not yet assignedNot reported[1124380]
Debianuxplaysourcetrixie(unfixed)not yet assignedNot reported[1124380]
Debianuxplaysourcebookworm(unfixed)not yet assignedNot reported[1124380]

[Debian bug #1124380]

Notes

[trixie] uxplay: Minor issue [bookworm] uxplay: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [uxplay]Affected
    Details (2)

    • 1.62-1 · amd64 · bookworm

      Affected

      dsa · uxplay · debian · bookworm

    • 1.62-1 · arm64 · bookworm

      Affected

      dsa · uxplay · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]