CVE-2025-10824

axboe fio init.c __parse_jobs_ini use after free

State: Published
Severity: 4.8 Medium
Published: Sep 23, 2025
Updated: Sep 23, 2025
Reserved: Sep 21, 2025

Description

A vulnerability was determined in axboe fio up to 3.41. This impacts the function __parse_jobs_ini of the file init.c. Executing manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-416 Use After Free
CWE-119 Memory Corruption

Affected Products

Product	Versions
fioaxboe	3.0Affected 3.1Affected 3.2Affected 3.3Affected 3.4Affected 3.5Affected 3.6Affected 3.7Affected 3.8Affected 3.9Affected 3.10Affected 3.11Affected 3.12Affected 3.13Affected 3.14Affected 3.15Affected 3.16Affected 3.17Affected 3.18Affected 3.19Affected 3.20Affected 3.21Affected 3.22Affected 3.23Affected 3.24Affected and 17 more versions

References

VDB-325181 | axboe fio init.c __parse_jobs_ini use after freevdb-entrytechnical-description
VDB-325181 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #654072 | Jens Axboe Fio 3.41 / master commit 84787ad Use After Freethird-party-advisory
https://github.com/axboe/fio/issues/1981issue-tracking
https://github.com/user-attachments/files/22266756/poc.zipexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.