7.5

CVE-2025-49140: pion interceptor

CVSS: 7.5v3.1HighDeferred
AliasesUBUNTU-CVE-2025-49140CGA-4qg5-3g3v-g3mfCGA-5hp9-hmrq-28mp
Published 09-06-2025Last modified 10-06-2025
Open JSON

Vulnerability summary

CVE-2025-49140 is a high (CVSS 7.5) vulnerability in pion interceptor. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.49%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 3
OPENSUSE-SU-2025:15225-1CGA-2W33-3PVQ-H8GPCGA-RM98-2Q7F-VH4Q

Timeline

  1. 09-06-2025
    PublishedVulnerability first disclosed.
  2. 10-06-2025
    Last modifiedVulnerability information updated.

Description

Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can be exploited to trigger a panic with Pion based SFU via crafted RTP packets, This only affect users that use pion/interceptor. Users should upgrade to v0.1.39 or later, which validates that: `padLen > 0 && padLen <= payloadLength` and return error on overflow, avoiding panic. If upgrading is not possible, apply the patch from the pull request manually or drop packets whose P-bit is set but whose padLen is zero or larger than the remaining payload.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.49%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

0.00 pp

From 0.49% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard6 products
  • ipfs-cluster-fips< 1.1.4-r2
  • ipfs-cluster-fips-compat< 1.1.4-r2
  • ipfs-cluster-fips-oci-entrypoint< 1.1.4-r2
  • k3s< 1.33.1.1-r1
  • k3s-multicall< 1.33.1.1-r1
Wolfi3 products
  • k3s< 1.33.1.1-r1
  • k3s-multicall< 1.33.1.1-r1
  • k3s-static< 1.33.1.1-r1
Github.com/pion1 product
  • interceptor≥ 0.1.36, < 0.1.39
Pion1 product
Ubuntu1 product
  • golang-github-pion-interceptorAll versions (No fix recorded)

5 vendors · 12 products

References

9 links