Quick answers
- Is CVE-2025-61029 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-61029 being exploited in the wild.
- How severe is CVE-2025-61029?
- High severity, with a CVSS score of 7.5, published 23 June 2026.
- Which products and versions are affected?
- OpenLink Software Virtuoso OpenSource 7.2.11.
- Is there a fix for CVE-2025-61029?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-61029 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-61029?
- Check whether you run OpenLink Software Virtuoso OpenSource at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in the sqlo_untry component of OpenLink Virtuoso OpenSource v7.2.11. The issue is triggered during the processing of complex, nested SQL statements (specifically within CREATE TABLE constraints or SELECT queries), leading to a null pointer dereference or similar memory corruption that causes the database process to crash. An attacker can exploit this by submitting a malformed SQL query over the network without requiring prior authentication. The root cause is located in the SQL optimizer/compiler logic (sqlo_untry), as evidenced by stack traces showing a crash during DDL constraint definition.
Affected products
- OpenLink Virtuoso OpenSource 7.2.11
Timeline
- 2024-01-07: disclosed: Issue reported on GitHub with PoC
- 2026-06-23: advisory: CVE published and NVD record created