CVE-2025-13654: Zevv Duc

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A stack buffer overflow vulnerability exists in the buffer_get function of duc, a disk management tool, where a condition can evaluate to true due to underflow, allowing an out-of-bounds read.

Affected products

• Zevv Duc: before 1.4.6 (fixed in 1.4.6)

Published 2025-12-05. Last modified 2026-09-25.