In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

The buffer overflow vulnerability in iperf3 allows an attacker to craft malicious input that exceeds the allocated buffer size during network performance testing. Successfully exploiting this vulnerability could lead to arbitrary code execution on the target system. This could grant the attacker complete control over the affected machine, enabling them to install malware, steal sensitive data, or disrupt network operations. Given iperf3's use in network benchmarking and performance analysis, this vulnerability poses a significant risk to systems involved in these activities.

Systems administrators and network engineers who utilize iperf3 for network performance testing are at risk. This includes organizations involved in network infrastructure management, software development, and quality assurance, particularly those using older, unpatched versions of iperf3.

• linux / server:

journalctl -u iperf3 -f | grep -i overflow

• linux / server:

ps aux | grep iperf3 --skip-rx-copy

1. 2025-08-03Disclosure

   disclosure

1. Gereserveerd2025-07-21
2. Gepubliceerd2025-08-03
3. Gewijzigd2025-08-04
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-54351 is to upgrade to iperf3 version 3.19.1 or later. If upgrading is not immediately feasible, consider temporarily disabling the --skip-rx-copy option, as this is the trigger for the vulnerability. Network firewalls and intrusion detection systems (IDS) should be configured to monitor for unusual network traffic patterns associated with iperf3, particularly those involving the --skip-rx-copy flag. After upgrading, confirm the fix by running iperf3 with the --skip-rx-copy flag and verifying that no crashes or unexpected behavior occurs.