MEDIUM 6.5 Microsoft

CVE-2025-48964

ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).

Microsoft Security Update 2025-Jul: ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).

Affected Products

References

Published: 2025-07-08 · Source: Microsoft · Feed updated: 2026-08-04
This medium severity vulnerability with a CVSS score of 6.5 was published on 2025-07-08 via Microsoft. Affected: cbl2 iputils 20211215-3 on CBL Mariner 2.0, azl3 iputils 20240117-2 on Azure Linux 3.0, cbl2 iputils 20211215-4 on CBL Mariner 2.0.
vulnfeed aggregates 9214 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.