CVE-2025-48964: iputils Integer Overflow or Wraparound

Vulnerability summary

CVE-2025-48964 is a medium (CVSS 6.5) Integer Overflow or Wraparound vulnerability in iputils. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.1% of scored vulnerabilities.

Timeline

1. 22-07-2025
   PublishedVulnerability first disclosed.
2. 26-08-2025
   Last modifiedVulnerability information updated.

Description

ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.