Threat database

CVE-2025-50681 is a high-severity vulnerability in igmpproxy versions before commit 2b30c36 that allows remote attackers to cause a denial of service via crafted IGMPv3 membership report packets. The flaw arises from insufficient validation in the recv_igmp() function, leading to a NULL pointer dereference when processing malformed multicast traffic. This can crash the igmpproxy application, which is commonly used in embedded networking devices such as home routers and media gateways. Exploitation requires no authentication or user interaction and can be executed remotely over a LAN. While no known exploits are currently in the wild, unpatched devices remain at risk. The vulnerability impacts availability but does not affect confidentiality or integrity. European organizations relying on affected IoT and networking devices for IPTV or multicast streaming services should prioritize patching or mitigating this issue to prevent service disruption.