What is the CVSS score of CVE-2025-69808?

CVE-2025-69808 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Bareiron are affected by CVE-2025-69808?

CVE-2025-69808 presents critical security risk, a out-of-bounds read vulnerability rated CVSS 9.1.

How to fix or mitigate CVE-2025-69808?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Bareiron CVE-2025-69808

EUVD-2025-208765 CRITICAL

Out-of-bounds Read (CWE-125)

2026-03-16 mitre

Buffer Overflow Denial Of Service Information Disclosure N A

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

8.2 HIGH

Unauthenticated single-packet network trigger (AV:N/AC:L/PR:N/UI:N); DoS crash is A:H, but an OOB read leaks only bounded adjacent memory so C:L, not C:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 20:05 euvd

EUVD-2025-208765

Analysis Generated

Mar 16, 2026 - 20:05 vuln.today

CVE Published

Mar 16, 2026 - 00:00 nvd

CRITICAL 9.1

DescriptionCVE.org

An out-of-bounds memory access (OOB) in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to access sensitive information and cause a Denial of Service (DoS) via supplying a crafted packet.

AnalysisAI

Out-of-bounds memory read in p2r3 Bareiron (a lightweight, from-scratch Minecraft server written in C) at commit 8e4d40 allows remote unauthenticated attackers to leak adjacent process memory and crash the server by sending a single crafted protocol packet. The dual impact - information disclosure plus denial of service - carries a CVSS 9.1 rating, but EPSS is very low (0.07%, 20th percentile) and it is not in CISA KEV; a dedicated third-party CVE write-up exists, indicating publicly available exploit code exists. No active exploitation has been confirmed.

Technical ContextAI

Bareiron is a minimalist Minecraft: Java Edition-compatible server implemented in low-level C, where inbound client packets are parsed by hand-written buffer logic without a memory-safe runtime. The flaw is classified as CWE-125 (Out-of-Bounds Read): a crafted packet drives the parser to read past the bounds of an allocated buffer - typically because an attacker-controlled length or offset field is trusted without validation against the actual received byte count. In C this over-read returns whatever adjacent heap or stack bytes exist, which can expose sensitive in-memory data or dereference invalid memory and crash the process. The CPE string in the feed is a placeholder (cpe:2.3:a:n/a:n/a), so no machine-readable product/version identifier is available and the affected component is pinned only by the source commit hash 8e4d40.

RemediationAI

No vendor-released patched version is identified at time of analysis (the vulnerability is pinned to commit 8e4d40 with no tagged fix release in the feed), so update to the latest upstream commit from https://github.com/p2r3/bareiron/ and confirm the packet-parsing bounds check has been added before deploying. Until a confirmed fix commit is available, apply compensating controls: do not expose the server directly to the internet - bind it to localhost or a trusted LAN and place it behind a firewall or allowlist so only known player IPs can reach the game port (trade-off: breaks public/open-join servers); run the server as an unprivileged, sandboxed user with automatic restart supervision to blunt the DoS impact (trade-off: mitigates availability but not the memory-disclosure read); and monitor for malformed-packet crashes. Corroborating advisory details are at https://vuldb.com/?id.351320 and the technical write-up at https://github.com/vmpr0be/bareiron-vr/blob/main/CVE-2025-69808.md.