Stack-based buffer overflow in F5 BIG-IP (CVE-2025-53521) — possible remote code execution on an edge device; CVSS 9.8

1A stack-based buffer overflow

A stack-based buffer overflow is a defect in which data is written beyond an allocated region on the "stack" a program uses as temporary workspace, corrupting adjacent control information (such as the return address). Exploited precisely, an attacker can hijack the program's flow of execution and run arbitrary code. This is said to be possible in F5 BIG-IP's Access Policy Manager (APM) module.

2BIG-IP as an edge device

What matters is that BIG-IP is an "edge device." BIG-IP handles load balancing, application delivery, and remote access (VPN), placed at the internet boundary that first receives access from outside. Like the Citrix NetScaler covered separately on this site, such edge devices are exposed to the internet at all times and, once seized, become the entry point to the interior — a prime target for attackers. Remote code execution on an edge device is extremely weighty as the origin of damage.

3A CVSS of 9.8, the top tier

The CVSS published on NVD is 9.8 (CRITICAL), the highest tier, with unauthenticated, remote, no-user-interaction conditions met. CISA's short 3-day remediation window underscores the urgency. The response is prompt updating per F5's guidance.

4Few entries carry a CVSS score

A KEV entry does not necessarily include CVSS, the numeric score of severity. Counting the records this site holds that carry a value leaves only a small share.

That most entries carry no number means sorting KEV by severity to set priorities does not work as it stands. What KEV supplies is not a ranking of severity but the fact of confirmed exploitation and a remediation date. BIG-IP handles load balancing, application delivery and remote access, sitting at the boundary that first receives access from outside, so taking it opens the way inward.