CVE-2025-54351 is a high severity (CVSS 8.9) buffer overflow in net.c of iperf3. It occurs when the skip-rx-copy option is used with MSG_TRUNC receives. Versions before 3.19.1 are affected, and iperf 3.19.1 contains the fix. The sections below cover who is affected, how to check, and what to do first.
What's affected
- iperf3 before 3.19.1 is affected, per the record.
- The overflow is tied to the skip-rx-copy option. Installs that never use it may have a smaller exposure, but upgrade anyway.
The record lists CVSS 8.9 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check the version.
iperf3 --version
Then search your scripts and service units for use of the skip-rx-copy option so you know whether the risky path is in use.
grep -r "skip-rx-copy" /etc /opt /usr/local 2>/dev/null
What to do now
- Upgrade to iperf 3.19.1 or later, or take your distribution's patched package.
- Remove the skip-rx-copy option from scripts until you are patched.
- Keep iperf3 servers off public networks.
- Rebuild images that embed iperf3.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The record tags this as CWE-420, unprotected alternate channel, with a buffer overflow in the receive path as the effect. Two iperf3 bugs were fixed in the same release, CVE-2025-54349 and this one, so one upgrade covers both.
The score is high because the network vector and the impact on confidentiality, integrity and availability are all rated heavily. Real exposure depends on whether untrusted peers can reach your iperf3 process.
Severity scores are a starting point. The score for this entry is 8.9, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Is a fix available?
Yes, iperf 3.19.1.
Do I need to stop using the option?
If you cannot upgrade yet, avoiding it is a sensible stopgap. The record ties the overflow to its use.
Sources
- https://github.com/esnet/iperf/commit/969b7f70c447513e92c9798f22e82b40ebc53bf0
- https://github.com/esnet/iperf/releases/tag/3.19.1
Last reviewed: 18 October 2026.
