Medium severity · published Jan 13, 2026
CVE-2025-37179
Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
ArubaOS (AOS) · Hewlett Packard Enterprise (HPE)
8.12.0.0 through 8.13.1.0; 8.10.0.0 through 8.10.0.20 · source: vendor
AR
Arubaos · Arubanetworks
8.6.0.0 before 8.10.0.21; 8.11.0.0 before 8.13.1.1 · source: NVD
Affected product
AA
ArubaOS (AOS)
Hewlett Packard Enterprise (HPE)
More from ArubaOS (AOS)
10.0
CVE-2026-79851
Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
10.0
CVE-2026-79850
Authentication Bypass Leading to Remote Code Execution in AOS-8
10.0
CVE-2026-79849
Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
10.0
CVE-2026-79848
Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
10.0
CVE-2026-79847
Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10