CVE-2025-68276: Avahi has a reachable assertion in avahi_wide_area_scan_cache
Avahi has a reachable assertion in avahiwideareascancache
Other sources
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHILOOKUPUSEWIDEAREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68276?
CVE-2025-68276 has been classified as a high severity vulnerability due to the potential for unprivileged local users to crash the avahi-daemon.
How do I fix CVE-2025-68276?
To fix CVE-2025-68276, upgrade Avahi to version 0.9 or later that addresses the assertion issue in avahi_wide_area_scan_cache.
Who is affected by CVE-2025-68276?
All users running Avahi version 0.9-rc2 or earlier are affected by CVE-2025-68276.
Can CVE-2025-68276 be exploited remotely?
No, CVE-2025-68276 requires local access to the system to exploit the vulnerability.
What impact does CVE-2025-68276 have on my system?
The impact of CVE-2025-68276 is that it can cause a denial of service by crashing the avahi-daemon when triggered by unprivileged local users.