CVE catalog

CVE-2025-8746

autogen: CVE-2025-8746

Severity: Low · CVSS 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: Aug 9, 2025, 6:02:07 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.23% · Oct 25, 2026

A vulnerability, which was classified as problematic, was found in GNU libopts up to 27.6. Affected is the function __strstr_sse2. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. This issue was initially reported to the tcpreplay project, but the code maintainer explains, that this "bug appears to be in libopts which is an external library." This vulnerability only affects products that are no longer supported by the maintainer.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	autogen	sid	`1:5.18.16-9`	fixed
Debian	autogen	forky	`1:5.18.16-9`	fixed
Debian	autogen	trixie	`1:5.18.16-7`	vulnerable
Debian	autogen	bookworm	`1:5.18.16-5`	vulnerable
Opensuse	autogen	leap 16.0	`5.18.16-160000.3.1`	fixed
Opensuse	tcpreplay	tumbleweed	`4.5.1-2.1`	fixed
Suse	autogen	linux enterprise server 16.0	`5.18.16-160000.3.1`	fixed
Suse	autogen	linux enterprise server for sap applications 16.0	`5.18.16-160000.3.1`	fixed
Opensuse	autogen	tumbleweed	`5.18.16-8.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	autogen	source	sid	`1:5.18.16-8`	unimportant	Not reported	Not reported
Debian	autogen	source	forky	`1:5.18.16-8`	unimportant	Not reported	Not reported
Debian	autogen	source	trixie	`(unfixed)`	unimportant	Not reported	Not reported
Debian	autogen	source	bookworm	`(unfixed)`	unimportant	Not reported	Not reported
Opensuse	autogen	rpm	leap 16.0	`5.18.16-160000.3.1`	Not reported	OPENSUSE-SU-2026:20270-1	Not reported
Opensuse	tcpreplay	rpm	tumbleweed	`4.5.1-2.1`	Not reported	OPENSUSE-SU-2025:15570-1	Not reported
Suse	autogen	rpm	linux enterprise server 16.0	`5.18.16-160000.3.1`	Not reported	SUSE-SU-2026:20590-1	Not reported
Suse	autogen	rpm	linux enterprise server for sap applications 16.0	`5.18.16-160000.3.1`	Not reported	SUSE-SU-2026:20590-1	Not reported
Opensuse	autogen	rpm	tumbleweed	`5.18.16-8.1`	Not reported	OPENSUSE-SU-2025:15557-1	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[autogen]Affected
Details (2)
- 1:5.18.16-5 · amd64 · bookworm
  Affected
  dsa · autogen · debian · bookworm; dsa · autogen · debian · 12
- 1:5.18.16-5 · arm64 · bookworm
  Affected
  dsa · autogen · debian · bookworm; dsa · autogen · debian · 12
[autogen-doc]Affected
Source package: [autogen]
Details (2)
- 1:5.18.16-5 · all · bookworm
  Affected
  dsa · autogen · debian · bookworm; dsa · autogen · debian · 12
- 1:5.18.16-5 · all · bookworm
  Affected
  dsa · autogen · debian · bookworm; dsa · autogen · debian · 12
[libopts25]Affected
Source package: [autogen]
Details (2)
- 1:5.18.16-5 · amd64 · bookworm
  Affected
  dsa · autogen · debian · bookworm; dsa · autogen · debian · 12
- 1:5.18.16-5 · arm64 · bookworm
  Affected
  dsa · autogen · debian · bookworm; dsa · autogen · debian · 12
[libopts25-dev]Affected
Source package: [autogen]
Details (2)
- 1:5.18.16-5 · amd64 · bookworm
  Affected
  dsa · autogen · debian · bookworm; dsa · autogen · debian · 12
- 1:5.18.16-5 · arm64 · bookworm
  Affected
  dsa · autogen · debian · bookworm; dsa · autogen · debian · 12

[Debian 13 (Trixie)]

[autogen]Affected
Details (2)
- 1:5.18.16-7 · amd64 · trixie
  Affected
  dsa · autogen · debian · 13
- 1:5.18.16-7 · arm64 · trixie
  Affected
  dsa · autogen · debian · 13
[autogen-doc]Affected
Source package: [autogen]
Details (2)
- 1:5.18.16-7 · all · trixie
  Affected
  dsa · autogen · debian · 13
- 1:5.18.16-7 · all · trixie
  Affected
  dsa · autogen · debian · 13
[libopts25]Affected
Source package: [autogen]
Details (2)
- 1:5.18.16-7 · amd64 · trixie
  Affected
  dsa · autogen · debian · 13
- 1:5.18.16-7 · arm64 · trixie
  Affected
  dsa · autogen · debian · 13
[libopts25-dev]Affected
Source package: [autogen]
Details (2)
- 1:5.18.16-7 · amd64 · trixie
  Affected
  dsa · autogen · debian · 13
- 1:5.18.16-7 · arm64 · trixie
  Affected
  dsa · autogen · debian · 13

[openSUSE Tumbleweed]

[autoopts]Unknown
Source package: [autogen]
Details (1)
- 5.18.16-9.5 · x86_64 · tumbleweed
  Unknown · Fixed: 5.18.16-8.1
  Version impact unknown
  dsa · autogen · opensuse · tumbleweed
[libopts25]Unknown
Source package: [autogen]
Details (1)
- 5.18.16-9.5 · x86_64 · tumbleweed
  Unknown · Fixed: 5.18.16-8.1
  Version impact unknown
  dsa · autogen · opensuse · tumbleweed
[autogen]Fixed
Source package: [autogen]
Details (1)
- 5.18.16-9.5 · x86_64 · tumbleweed
  Fixed · Fixed: 5.18.16-8.1
  dsa · autogen · opensuse · tumbleweed
[tcpreplay]Fixed
Source package: [tcpreplay]
Details (1)
- 4.6.1-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 4.5.1-2.1
  dsa · tcpreplay · opensuse · tumbleweed

Observed: Oct 24, 2026, 8:25:52 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]