External risk intelligence

MaLion and MaLionCloud Heap-Based Buffer Overflow for Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-64693

MaLion and MaLionCloud are management and endpoint security solutions that typically require network-accessible services to facilitate communication between agents and the management console. Since the vulnerability involves processing remote requests in a product designed for broad network deployment and centralized administration, it is commonly deployed in a manner that creates an externally reachable management surface.

Buffer Overflow

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in MaLion and MaLionCloud's Security Point component that allows remote attackers to execute code with system privileges by exploiting a buffer overflow when processing a specially crafted request. This could lead to a compromise of the affected systems.

Code execution flaw in security software.
Affects remote management and endpoint security.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted network request to an unauthenticated MaLion or MaLionCloud instance. This request targets a flaw in how the system processes the Content-Length header, potentially allowing the attacker to overwrite memory and execute arbitrary code with SYSTEM privileges.

No authentication or special access required.
Triggered by sending a malformed network request.
Enables arbitrary code execution as SYSTEM.

Live Threat

Current exploitation, exposure, and threat context

A heap-based buffer overflow vulnerability in MaLion and MaLionCloud's Security Point, when processing Content-Length, could allow a remote, unauthenticated attacker to execute arbitrary code with SYSTEM privileges. This attack is possible when the affected component receives a specially crafted request, potentially impacting the confidentiality, integrity, and availability of the system.

System data and services at risk.
Specially crafted network requests could trigger.
Arbitrary code execution with SYSTEM privileges.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in MaLion and MaLionCloud's Security Point affects the core functionality of endpoint management and security, indicating that platform or infrastructure teams, alongside security operations, are likely responsible for managing and remediating this risk. The initial focus should be on identifying all deployed instances, assessing their exposure to remote unauthenticated attackers, and confirming their business criticality to prioritize remediation efforts.

Platform and security teams own remediation.
Verify remote reachability and critical assets.
Plan coordinated vendor engagement and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MaLion and what is the Security Point component?

MaLion and MaLionCloud are integrated IT asset management and endpoint security suites. Organizations use them to monitor devices, manage software distribution, and enforce security policies across their networks. The Security Point component is a core part of this architecture, responsible for facilitating communication and data exchange between the central management console and the endpoint agents installed on various systems.

What does heap-based buffer overflow mean in CVE-2025-64693?

This vulnerability is classified as CWE-122. It occurs when the software reserves a specific amount of memory for data but fails to check the size of incoming information before copying it. Because the flaw happens in the 'heap'—a pool of memory used for dynamic data—an attacker can intentionally provide an oversized value in a network header to overwrite adjacent memory. This corruption can confuse the program into running malicious commands with high-level system privileges.

How is this vulnerability triggered?

An attacker triggers the flaw by sending a specially crafted network request to the affected system. The issue specifically occurs when the software processes the 'Content-Length' header, which dictates how much data the server should expect. If the header is manipulated to mismatch the actual data sent, the overflow occurs. Legitimate, properly formatted requests that adhere to expected size protocols do not trigger this memory corruption.

Is my environment at risk from this CVE?

According to Halo Surface Signal, this vulnerability is particularly relevant to environments where MaLion or MaLionCloud services are reachable over the network. Because the software is designed for centralized administration, these management services are often placed in network segments that could be accessed remotely. If your instance is internet-facing or accessible from untrusted segments, it faces a higher degree of risk from unauthenticated attackers.

When should I prioritize a response to this threat?

You should prioritize this issue by first performing an inventory to locate all deployed MaLion and MaLionCloud instances. Since the vulnerability allows for code execution with SYSTEM privileges, treat any instance accessible from the network as a high priority. Coordinate with your platform and security teams to verify reachability, assess business impact, and monitor official vendor channels for available patches or configuration guidance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.