CVE-2025-68276

EUVD-2025-206280

12.01.2026, 18:15

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling
the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Affected Products (NVD)

Vendor	Product	Version
avahi	avahi	𝑥 < 0.9
avahi	avahi	0.9:rc1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

avahi

bookworm	no-dsa
bullseye	postponed
bullseye (security)	vulnerable
forky	0.8-18 fixed
sid	0.8-18 fixed
trixie	no-dsa

openSUSE / SLES Releases

openSUSE Product

Release

avahi

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 12 SP3	0.6.32-32.36.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

avahi-autoipd

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

avahi-compat-howl-devel

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

avahi-compat-mDNSResponder-devel

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

avahi-lang

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 12 SP3	0.6.32-32.36.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

avahi-utils

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 12 SP3	0.6.32-32.36.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

avahi-utils-gtk

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-client3

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 12 SP3	0.6.32-32.36.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-client3-32bit

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 12 SP3	0.6.32-32.36.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-common3

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 12 SP3	0.6.32-32.36.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-common3-32bit

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 12 SP3	0.6.32-32.36.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-core7

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 12 SP3	0.6.32-32.36.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-devel

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-glib-devel

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-glib1

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-gobject-devel

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-gobject0

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-libevent1

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libavahi-ui-gtk3-0

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libdns_sd

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 12 SP3	0.6.32-32.36.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

libdns_sd-32bit

suse enterprise server 12 SP3

0.6.32-32.36.1

fixed

libhowl0

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

typelib-1_0-Avahi-0_6

suse enterprise desktop 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise sap 15 SP7	0.8-150600.15.12.1 fixed
suse enterprise server 15 SP4	0.8-150400.7.26.1 fixed
suse enterprise server 15 SP7	0.8-150600.15.12.1 fixed

Common Weakness Enumeration

CWE-617 - Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References

https://github.com/avahi/avahi/commit/ede7048475c5d47d53890e3bc1350dda8e0b3688

https://github.com/avahi/avahi/pull/806

https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc