CVE-2025-3845 is a high severity buffer overflow flaw (CVSS 7.3) in markparticle WebServer, up to version 1.0. It affects Buffer::HasWritten in code/buffer/buffer.cpp and can be reached over the network without a login. The record lists no fixed version, so keep it off the internet and review the buffer code.
What's affected
The record names markparticle WebServer up to version 1.0. The affected function is Buffer::HasWritten in code/buffer/buffer.cpp, and the argument is writePos_. The record lists no fixed version.
The record lists the weakness as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-120 (buffer copy without checking the size of input). The CVSS 3.1 score is 7.3 (high), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The vector shows the flaw can be reached over the network, and no login is needed. Confidentiality impact is rated low, integrity low and availability low.
The record says the exploit has been disclosed to the public and may be used. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false. Treat any copy that is reachable from the internet as the priority.
How to check if you're exposed
WebServer is a C++ project built from source, so check your build and deployment.
- Find out whether you built or deployed this project. Look for the source tree or a binary built from it:
find / -type f -name 'buffer.cpp' -path '*code/buffer*' 2>/dev/null
- If you have the source, check the commit and compare it with the project's history:
git log -1 --format=%H
- Read Buffer::HasWritten and the code that calls it. Look for places where writePos_ can move past the end of the buffer.
- Check who can reach the listening port, and review logs for crashes or restarts of the process.
If you manage many repositories, the free in-browser dependency scan covers the libraries your projects pull in, and the Gold directory lets you look up other CVEs by product. Neither replaces reviewing the code of an application you deploy by hand.
What to do now
- Do not expose this server to the internet. Put it behind a reverse proxy, VPN or allow list.
- Check the project page for a newer commit. The record lists no fixed version, so the advisory should be checked before you plan an upgrade.
- Add bounds checks wherever the write position is advanced, and fail the request if the data would not fit.
- Build with compiler hardening such as stack protection and address sanitizer in test builds, and run your tests under it.
- Run the process under an unprivileged account, ideally in a container with limited access.
- If this is a learning project, keep it off production networks.
Why it matters
A buffer overflow happens when a program copies input into a fixed size block of memory without first checking that it fits. The extra data spills into neighboring memory. The usual result is a crash. In the worst case an attacker can change how the program runs.
Network services written in C or C++ are exposed to this class of bug because the language leaves bounds checking to the developer. The weakness classes the record lists describe exactly that. Fixing it means checking lengths before every copy, or using safer string and buffer handling.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version?
The record does not list one. Check the project page and the record's references before assuming a patch exists.
What does the record say about the attack?
It says the attack can be launched remotely and that the exploit has been disclosed to the public. It does not say it is exploited in the wild.
Sources
- Gold entry for CVE-2025-3845
- NVD record for CVE-2025-3845, published 2025-04-21, as summarized above
- Reference listed in the record
- Reference listed in the record
- Reference listed in the record
- Reference listed in the record
Last reviewed: 18 October 2026.
