CVE-2025-63927: AIRPIG2011 IEC104

Medium severity, CVSS 4.0. EPSS: 0.2% chance of exploitation in the next 30 days.

A heap-use-after-free vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). During multi-threaded client execution, the function Iec10x_Scheduled can access memory that has already been freed, potentially causing program crashes or undefined behavior. This may be exploited to trigger a denial-of-service or memory corruption.

Affected products

• AIRPIG2011 IEC104: up to and including 2019-07-08

Published 2025-11-12. Last modified 2026-06-17.