CVE-2025-50681: 
NixOS vulnerability analysis and mitigation

CVE-2025-50681 is a buffer overflow and NULL pointer dereference vulnerability in igmpproxy 0.4 that allows remote attackers to cause a denial of service (application crash) by sending a crafted IGMPv3 membership report packet. The flaw exists in the igmpPacketKind() function in src/igmp.c, where an unsafe sprintf() call into a fixed 20-byte buffer can be overflowed by attacker-controlled type and code values, and in the recv_igmp() function where an invalid group record type can trigger a NULL pointer dereference via inet_fmtsrc(). Affected software is igmpproxy version 0.4 prior to commit 2b30c36, widely deployed in embedded networking environments and consumer IoT devices such as home routers and media gateways. The vulnerability was disclosed on December 19, 2025, with a CVSS v3.1 base score of 7.5 (High) (GitHub Issue, Red Hat CVE).

The root cause is a classic buffer overflow (CWE-120) in the igmpPacketKind() function in src/igmp.c. The function uses an unsafe sprintf() to write into a statically allocated 20-byte buffer (unknown[20]) using the format string "unk: 0x%02x/0x%02x ", but the formatted output can exceed 20 bytes when attacker-controlled type and code values are large (e.g., 0xfffffffff and 0x41414134141), overwriting the stack canary and causing termination. Additionally, in recv_igmp(), an invalid group record type in a crafted IGMPv3 membership report packet can cause a NULL pointer dereference when the code attempts to log the source address via inet_fmtsrc(). Exploitation requires only the ability to send malformed multicast traffic across a LAN to a host running igmpproxy — no authentication or user interaction is needed. A proof-of-concept demonstrating the buffer overflow is publicly available (GitHub Issue, PoC Gist).

Successful exploitation causes igmpproxy to crash, resulting in a denial of service that disrupts multicast traffic handling on the affected device. This directly impacts IPTV and other streaming services that depend on igmpproxy for multicast proxy functionality on home routers, media gateways, and other embedded IoT devices. There is no known confidentiality or integrity impact — the vulnerability is limited to availability. Devices running unpatched igmpproxy on a LAN are exposed to repeated crash-and-restart cycles if an attacker continuously sends malformed packets (GitHub Issue, Red Hat CVE).

A proof-of-concept exploit is publicly available on GitHub (issue #97 in the pali/igmpproxy repository) and a PoC gist was published by the original reporter (miora-sora). The vulnerability requires no privileges and no user interaction, and is exploitable from the network without authentication. There is no evidence of active in-the-wild exploitation at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.00129 (low probability of exploitation in the near term) (GitHub Issue, Red Hat CVE).

1. Reconnaissance: Identify hosts on the LAN running igmpproxy version 0.4 (pre-commit 2b30c36), commonly found on home routers and media gateways providing IPTV or multicast services.
2. Craft malformed IGMPv3 packet: Construct an IGMPv3 membership report packet with an invalid group record type and a malicious source address. Set the type and code fields to large values (e.g., type=0xfffffffff, code=0x41414134141) to trigger the buffer overflow in igmpPacketKind().
3. Send packet to target: Transmit the crafted multicast packet to the target host across the LAN. No authentication or special network position beyond LAN access is required.
4. Trigger crash: The recv_igmp() function processes the packet; the invalid group record type causes either a stack buffer overflow via the unsafe sprintf() in igmpPacketKind() (overwriting the stack canary and terminating the process) or a NULL pointer dereference in inet_fmtsrc(), both resulting in an application crash.
5. Achieve denial of service: igmpproxy crashes, disrupting multicast traffic forwarding and any dependent services (e.g., IPTV). Repeated packet transmission can prevent service recovery (GitHub Issue, PoC Gist).

• Network: Unusual IGMPv3 membership report packets with malformed or oversized type/code fields or invalid group record types arriving on multicast-enabled interfaces; unexpected IGMP traffic from unknown LAN sources.
• Logs: System logs (syslog/journald) showing igmpproxy process termination with signals such as SIGABRT (stack canary violation) or SIGSEGV (NULL pointer dereference); repeated igmpproxy restart events in service manager logs (e.g., systemd).
• Process: igmpproxy process repeatedly crashing and restarting; absence of igmpproxy in the process list when it should be running; core dump files generated in the igmpproxy working directory.
• File System: Presence of core dump files (e.g., core, core.<pid>) in the igmpproxy working directory following unexpected crashes (GitHub Issue).

The fix is available in commit 2b30c36e6ab5b21defb76ec6458ab7687984484c of the igmpproxy repository, which replaces the unsafe sprintf() call with snprintf(unknown, sizeof unknown, ...) to prevent the buffer overflow. Users should update igmpproxy to a version incorporating this commit or later. As a network-level workaround, restrict IGMPv3 traffic to trusted sources using firewall rules or IGMP snooping on managed switches, and segment multicast traffic to limit exposure. Organizations unable to patch immediately should monitor for unexpected igmpproxy crashes and consider disabling igmpproxy if multicast functionality is not required (GitHub Commit, Red Hat CVE).

Red Hat has published a security advisory tracking this CVE, and Tenable has released a Nessus detection plugin (plugin ID 279446) for the vulnerability. The issue was originally reported by researcher miora-sora on September 7, 2024, via the igmpproxy GitHub issue tracker, with a public PoC gist. Coverage has been limited to vulnerability aggregators and security blogs, with no major media coverage or significant social media discussion observed (Red Hat CVE, Tenable Plugin, GitHub Issue).