Avahi CVE-2025-59529

Requires an unprivileged local account with access to the simple-protocol unix socket /run/avahi-daemon/socket on a host running avahi-daemon (versions up to and including 0.9-rc2); no authentication beyond local socket access and no user interaction are needed. The flaw cannot be mitigated by configuration because avahi-daemon provides no option to disable that socket, though exploitation is LIMITED to local users and can be constrained by post-start socket permission changes or SELinux restrictions. It is NOT remotely exploitable, and resolution requests arriving via DBus - including avahi-resolve, avahi-resolve-address, and avahi-resolve-host-name - are not directly affected, narrowing real-world impact to the socket-based simple-protocol path.

This is a genuine but moderate-priority issue, and the available signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) accurately reflects a local, low-complexity, low-privilege availability-only flaw: no confidentiality or integrity impact, and the attacker must already have a local account with access to the /run/avahi-daemon/socket unix socket. EPSS is low at 0.18% (7th percentile), which aligns with the local-only attack vector - this is not a remotely mass-exploitable bug, so low internet-facing exploitation probability is expected and not a contradiction. The vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation; exploitation status is 'publicly available exploit code exists' (a POC/writeup is referenced via the GitHub Security Advisory GHSA-73wf-3xmj-x82q and the zeropath.com analysis), which must NOT be conflated with in-the-wild exploitation. No SSVC decision record was supplied. The root cause is confirmed by source code: server_work() unconditionally accept()s and client_new() always increments n_clients with no enforcement of CLIENTS_MAX (CWE-400 resource exhaustion). Net assessment: a real, easily-triggered local denial-of-service that degrades a widely-deployed system service, but low urgency for internet-exposed threat models because it cannot be reached remotely and has no data-impact - patch on normal maintenance cadence, prioritizing multi-user and shared Linux hosts.

An unprivileged local user on a multi-user Linux host writes a short loop that repeatedly connects to the avahi-daemon simple-protocol unix socket (/run/avahi-daemon/socket) without ever hitting the intended 50-client limit. Because every connection is accepted and counted without bound, the daemon exhausts its file descriptors and memory, and each failed accept() also floods the system log, degrading the whole host. A public POC/advisory exists, and since the CVSS vector is AV:L/AC:L, the attack is trivial to script and requires no special timing or user interaction.