CVE-2025-9386: 
NixOS vulnerability analysis and mitigation

A use-after-free vulnerability has been identified in appneta tcpreplay versions up to 4.5.1, specifically in the getl2lenprotocol function of the tcprewrite component's get.c file. The vulnerability was disclosed on August 24, 2025, and affects the tcpreplay package (NVD, VulDB).

The vulnerability is classified with a CVSS v4.0 Base Score of 4.8 (Medium) and CVSS v3.1 Base Score of 5.3 (Medium). The vulnerability vector is CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N, indicating local access is required with low attack complexity. The weakness is categorized under CWE-416 (Use After Free) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) (AttackerKB).

The vulnerability affects the confidentiality, integrity, and availability of the system, each with a low impact rating. The attack requires local access and low privileges to execute, potentially leading to memory corruption issues (VulDB).

The recommended mitigation is to upgrade to tcpreplay version 4.5.2-beta3 or later, which contains the fix for this vulnerability. This is the primary and sufficient solution to resolve the security issue (Debian).