How severe is CVE-2025-54409?

CVE-2025-54409 has a CVSS 3.x base score of 6.2, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2025-54409 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-54409?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-54409 have an EU (EUVD) identifier?

Yes. CVE-2025-54409 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-24863.

When was CVE-2025-54409 published?

CVE-2025-54409 was published on 2025-08-14 and last updated on 2026-06-17.

CVE-2025-54409

CVE-2025-54409 is a medium-severity vulnerability in Advanced Intrusion Detection Environment Project Advanced Intrusion Detection Environment with a CVSS 3.x base score of 6.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-476.

Key facts

Severity: Medium (CVSS 3.x base score 6.2)
EPSS exploit prediction: 0% (12th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-24863
Weakness: CWE-476
Affected product: Advanced Intrusion Detection Environment Project Advanced Intrusion Detection Environment
Published: 2025-08-14
Last modified: 2026-06-17

Description

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Frequently asked questions

What is CVE-2025-54409?: AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.
How severe is CVE-2025-54409?: CVE-2025-54409 has a CVSS 3.x base score of 6.2, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2025-54409 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-54409?: CVE-2025-54409 affects Advanced Intrusion Detection Environment Project Advanced Intrusion Detection Environment. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-54409?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-54409 have an EU (EUVD) identifier?: Yes. CVE-2025-54409 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-24863.
When was CVE-2025-54409 published?: CVE-2025-54409 was published on 2025-08-14 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:advanced_intrusion_detection_environment_project:advanced_intrusion_detection_environment:*:*:*:*:*:*:*:*

More vulnerabilities in Advanced Intrusion Detection Environment Project Advanced Intrusion Detection Environment

CVE-2021-45417 — High (CVSS 7.8): AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended…
CVE-2025-54389 — Medium (CVSS 6.2): AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output…

All CVEs affecting Advanced Intrusion Detection Environment Project Advanced Intrusion Detection Environment →

Other CWE-476 (NULL Pointer Dereference) vulnerabilities

CVE-2022-36648 — Critical (CVSS 10.0): The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier,…
CVE-2020-14500 — Critical (CVSS 10.0): Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.
CVE-2010-2495 — Critical (CVSS 10.0): The pppol2tp_xmit function in drivers/net/pppol2tp.c in the L2TP implementation in the Linux kernel before 2.6.34 does…
CVE-2026-46195 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building…
CVE-2026-31657 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by…
CVE-2026-31436 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix possible wrong descriptor…

Browse all CWE-476 (NULL Pointer Dereference) vulnerabilities →