CVE-2025-11010

MediumCVSS 5.3

Published: 26/09/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

A vulnerability has been found in libucl up to version 0.9.2 in the ucl_include_common function of /src/ucl_util.c. Manipulation leads to a heap-based buffer overflow. Local access is required and the exploit has been publicly disclosed.

Risk Assessment

The vulnerability may allow a local attacker to execute code or crash applications using libucl. Since the exploit is public, the risk of exploitation is high.

Recommendation

Update libucl to a version newer than 0.9.2 or apply available patches. Restrict local access to systems processing untrusted UCL files.

Other vulnerabilities in libucl

CVE-2026-0708High
A flaw was found in libucl that allows a remote attacker to exploit a specially crafted Universal Configuration Language (UCL) input containing a key with an embedded null byte. This can lead to a segmentation fault in the `ucl_object_emit` function, resulting in a Denial of Service (DoS) for the affected system.

Original NVD description (English source)

A vulnerability has been found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_include_common of the file /src/ucl_util.c. Such manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS