BaseFortify

Publication date: 2025-12-18

Last updated on: 2025-12-23

Assigner: Elastic

Description

Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cause significant resource exhaustion via a single crafted UDP packet with an invalid fragment sequence number.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-18

Last Modified

2025-12-23

Generated

2026-07-06

AI Q&A

2025-12-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-68381

EUVD

EUVD-2025-204396

Affected Vendors & Products

Vendor	Product	Version / Range
elasticsearch	packetbeat	From 7.0.0 (inc) to 7.17.29 (inc)
elasticsearch	packetbeat	From 8.0.0 (inc) to 8.19.9 (exc)
elasticsearch	packetbeat	From 9.0.0 (inc) to 9.1.9 (exc)
elasticsearch	packetbeat	From 9.2.0 (inc) to 9.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Bounds Check (CWE-787) in Packetbeat that allows a remote unauthenticated attacker to exploit a buffer overflow by sending a specially crafted UDP packet with an invalid fragment sequence number. This can cause the application to crash or suffer significant resource exhaustion.

Impact Analysis

The vulnerability can impact you by causing the Packetbeat application to crash or experience significant resource exhaustion, potentially leading to denial of service or disruption of monitoring services.

Hi! I’m here to help you understand CVE-2025-68381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70