CVE-2025-68276: 
Avahi vulnerability analysis and mitigation

CVE-2025-68276 is a reachable assertion vulnerability in Avahi, a system that facilitates service discovery on local networks via the mDNS/DNS-SD protocol suite. It affects Avahi versions 0.9-rc2 and earlier, where unprivileged local users can crash avahi-daemon (when wide-area mode is disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. The vulnerability was disclosed on January 12, 2026, and patched in version 0.9-rc3. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is a reachable assertion (CWE-617) in the avahi_wide_area_scan_cache function in wide-area.c (line 725). When wide-area DNS-SD is disabled (the default since v0.9-rc2), the daemon fails to validate whether wide-area mode is active before processing record browser requests that carry the AVAHI_LOOKUP_USE_WIDE_AREA flag. An attacker can trigger this by calling the RecordBrowserNew D-Bus method directly, or indirectly through hostname/address/service resolvers and browsers that internally create such record browsers. The failed assertion causes avahi-daemon to abort via SIGABRT, resulting in a denial of service (GitHub Advisory, GitHub PR #806).

Successful exploitation results in a crash of the avahi-daemon process, disrupting mDNS/DNS-SD service discovery for all users on the affected local network. There is no impact on confidentiality or integrity — the vulnerability is purely a denial-of-service condition. No user interaction is required, and the attack requires only low-privilege local access, making it trivially exploitable by any unprivileged user on the system (GitHub Advisory).

1. Gain local access: Obtain any unprivileged local user account on a system running Avahi 0.9-rc2 or earlier with wide-area mode disabled (the default configuration).
2. Verify wide-area is disabled: Confirm that enable-wide-area=yes is absent from /etc/avahi/avahi-daemon.conf, meaning wide-area mode is off.
3. Send malicious D-Bus call: Use gdbus or busctl to call the ResolveHostName method (or RecordBrowserNew directly) with the AVAHI_LOOKUP_USE_WIDE_AREA flag (flag value 1) via the system D-Bus:

   gdbus call --system --dest org.freedesktop.Avahi --object-path / \
     --method org.freedesktop.Avahi.Server.ResolveHostName \
     -- -1 -1 yo.local -1 1

4. Trigger assertion failure: The avahi_wide_area_scan_cache function in wide-area.c hits a failed assertion (assert(e)), causing avahi-daemon to abort with SIGABRT and crash.
5. Result: The avahi-daemon process terminates, disrupting mDNS/DNS-SD service discovery on the local network until the daemon is restarted (GitHub Advisory, GitHub PR #806).

• Logs: System logs (e.g., /var/log/syslog or journalctl) showing avahi-daemon terminating with SIGABRT or assertion failure messages such as avahi-daemon: wide-area.c:725: avahi_wide_area_scan_cache: Assertion 'e' failed.
• Process: Unexpected termination or restart of the avahi-daemon process; monitoring tools may report repeated crashes of the service.
• D-Bus: D-Bus audit logs showing calls to org.freedesktop.Avahi.Server.ResolveHostName, org.freedesktop.Avahi.Server.RecordBrowserNew, or related methods with the wide-area flag (1) from unprivileged users, particularly when wide-area is disabled (GitHub Advisory).

Upgrade Avahi to version 0.9-rc3 or later, which includes the fix from commit ede7048 (PR #806) that refuses to create wide-area record browsers when wide-area mode is disabled. Downstream distributions including SUSE, Mageia, Ubuntu, and Red Hat have released updated packages. As an interim workaround, restrict unprivileged local user access to the Avahi D-Bus interface where operationally feasible, though this may impact legitimate service discovery functionality. Organizations using Microsoft Azure Linux (azl3/cbl2 packages) should apply the vendor-provided updates (GitHub Advisory, GitHub PR #806, Microsoft MSRC).

The fix was developed and merged by Avahi maintainer evverx on December 17, 2025, with the security advisory published on January 12, 2026. Multiple Linux distributions including SUSE, Mageia, Ubuntu, and Red Hat have issued security advisories and updated packages. The Yocto Project also backported the patch to openembedded-core and poky. Community reaction has been low-key given the moderate severity and limited exploitability of the vulnerability (GitHub PR #806).