CVE-2025-10824: fio 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19…

Affected technology

fio · 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22, 3.23, 3.24, 3.25, 3.26, 3.27, 3.28, 3.29, 3.30, 3.31, 3.32, 3.33, 3.34, 3.35, 3.36, 3.37, 3.38, 3.39, 3.40, 3.41
axboe

Description’s affected range: up to 3.41

Component: Not specified by the source
Function: __parse_jobs_ini
File: init.c

Attack conditions (VulDB, CVSS 4.0): Local · Low privileges required · No user interaction required

What an attacker can do

A local attacker with low privileges could trigger a use-after-free error in fio. VulDB’s CVSS 4.0 assessment (base score 1.9/10) rates confidentiality, integrity and availability impact as low. The description does not state a further attacker outcome.