BaseFortify

Publication date: 2025-12-18

Last updated on: 2025-12-23

Assigner: Elastic

Description

Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-18

Last Modified

2025-12-23

Generated

2026-07-06

AI Q&A

2025-12-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-68383

EUVD

EUVD-2025-204418

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	filebeat	From 7.0.0 (inc) to 7.17.29 (inc)
elastic	filebeat	From 8.0.0 (inc) to 8.19.9 (exc)
elastic	filebeat	From 9.0.0 (inc) to 9.1.9 (exc)
elastic	filebeat	From 9.2.0 (inc) to 9.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper validation of specified index, position, or offset in input within the Filebeat Syslog parser and the Libbeat Dissect processor. It allows a user to trigger a buffer overflow by sending a malformed Syslog message or using a malicious tokenizer pattern in the Dissect configuration, which can cause the Filebeat process to crash or panic.

Impact Analysis

The vulnerability can cause a denial of service by crashing the Filebeat process, potentially disrupting log collection and processing.

Hi! I’m here to help you understand CVE-2025-68383. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70