CVE-2025-32801 — Loading a malicious hook library can lead to local privilege escalation

CVE-2025-32801

Loading a malicious hook library can lead to local privilege escalation PUBLISHED

Description (CNA)

Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Affected (CNA)

Vendor / product	Versions
ISC / Kea	affected 2.4.0 through 2.4.1; affected 2.6.0 through 2.6.2; affected 2.7.0 through 2.7.8

CWE

CWE-94

References

https://kb.isc.org/docs/cve-2025-32801

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.