BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-10-21

Assigner: MITRE

Description

An out-of-bounds write in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20) to commit 480907 (2025-07-06) allows local attackers to cause a denial of service (host hypervisor crash) via a crafted PCI configuration space access. Given it's a heap overflow in a privileged hypervisor context, exploitation may enable arbitrary code execution or guest-to-host privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2025-10-21

Generated

2026-07-06

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61553

Affected Vendors & Products

Vendor	Product	Version / Range
bitvisor	bitvisor	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds write (heap overflow) in the VirtIO network device emulation within the BitVisor hypervisor. It occurs when a local attacker performs a crafted PCI configuration space access, leading to memory corruption in the hypervisor.

Impact Analysis

Exploitation of this vulnerability can cause a denial of service by crashing the host hypervisor. Additionally, because it is a heap overflow in a privileged context, it may allow an attacker to execute arbitrary code or escalate privileges from a guest virtual machine to the host hypervisor.

Hi! I’m here to help you understand CVE-2025-61553. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70