@RISK®: The Consensus Security Vulnerability Alert
October 16, 2025 – Vol. 25, Num. 40
CONTENTS:
=========================================================
INTERNET STORM CENTER SPOTLIGHT
OTHER INTERNET STORM CENTER ENTRIES
RECENT CVEs
=========================================================
INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
Microsoft Patch Tuesday October 2025
Published: 2025-10-14
Last Updated: 2025-10-14 17:55:39 UTC
by Johannes Ullrich (Version: 1)
I am experimenting today with a little bit of a cleaned-up patch overview. I removed vulnerabilities that affect Microsoft’s cloud systems (but appreciate Microsoft listing them at all), as well as vulnerabilities in third-party software like open source libraries. This should leave us with Microsoft-specific on-premises vulnerabilities. This month, this leaves 157 different vulnerabilities. Eight of the vulnerabilities are rated critical.
This month, Microsoft is discontinuing support for a number of different products:
Windows 10
Office 2016
Exchange Server 2016
Office 2019
Exchange Server 2019
Office and Exchange users are directed towards cloud and subscription offerings. For Office, you still have Office 2024 available if you would rather “own” the product. For Exchange, the Exchange Server Subscription Edition is available as of July.
Windows 10 users will have the option to sign up for “Extended Security Updates” (ESU). It has been offered as a low-cost alternative to retain security updates, and in some countries, it is offered for free …
Read the full entry: https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+October+2025/32368/
[Guest Diary] Building Better Defenses: RedTail Observations from a Honeypot
Published: 2025-10-09
Last Updated: 2025-10-09 03:24:19 UTC
by Jin Quan Low, SANS.edu BACS Student (Version: 1)
[This is a Guest Diary by Jin Quan Low, an ISC intern as part of the SANS.edu Bachelor’s Degree in Applied Cybersecurity (BACS) program.]
Ransomware is often the first word that comes to mind when we think about cybercriminals chasing financial gain. It barges in, locks files, drops ransom notes, and causes immediate disruption.
Cryptojacking, on the other hand, acts like a quiet trespasser. It slips in unnoticed, makes itself at home, and hijacks computing resources in the background to mine cryptocurrency while the victim stays unaware. Because it rarely causes disruptions, cryptojacking does not get the same level of attention as ransomware.
Over the past three months, my DShield honeypot captured repeated attempts to deploy RedTail, a cryptojacking malware first observed in early 2024. RedTail targets Monero cryptocurrency, typically gaining access through brute-forced SSH logins or exploiting vulnerabilities and deploying scripts to establish persistence and launch mining processes. The activity observed showed that compromises can extend beyond simple cryptomining, making RedTail a relevant case study for defenders.
Mapping Attacks to MITRE ATT&CK Tactics, Techniques and Procedures (TTPs)
Malware IOCs are very useful for quick detection, but they can be easily invalidated. Attackers only need to change part of their code, and those indicators lose all value. RedTail malware is no exception. Researchers had already detected different hashes of the same malware.
TTPs on the other hand rarely change and can be leveraged to detect similar threat behaviours. Hence, the observed attack involving RedTail malware will be mapped to the MITRE ATT&CK framework and how we can better defend ourselves …
Read the full entry: https://isc.sans.edu/diary/Guest+Diary+Building+Better+Defenses+RedTail+Observations+from+a+Honeypot/32312/
OTHER INTERNET STORM CENTER ENTRIES
Clipboard Pictures Exfiltration in Python Infostealer (2025.10.15)
https://isc.sans.edu/diary/Clipboard+Pictures+Exfiltration+in+Python+Infostealer/32372/
Heads Up: Scans for ESAFENET CDG V5 (2025.10.13)
https://isc.sans.edu/diary/Heads+Up+Scans+for+ESAFENET+CDG+V5/32364/
Wireshark 4.4.10 and 4.6.0 Released (2025.10.12)
https://isc.sans.edu/diary/Wireshark+4410+and+460+Released/32358/
RECENT CVEs
The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.
CVE-2025-57819 – FreePBX is vulnerable to unauthenticated access and remote code execution due to insufficient data sanitization, patched in versions 15.0.66, 16.0.89, and 17.0.3.
Product: FreePBX 15, 16, and 17
CVSS Score: 0
** KEV since 2025-08-29 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-57819ISC Podcast: https://isc.sans.edu/podcastdetail/9646
CVE-2025-24990 – Agere Modem driver has a vulnerability which will be removed in a upcoming update resulting in non-functioning fax modem hardware on Windows.
Product: Microsoft Agere Modem driver
CVSS Score: 7.8
** KEV since 2025-10-14 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24990ISC Diary: https://isc.sans.edu/diary/32368NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24990
CVE-2025-24052 – Agere Modem driver has a vulnerability which will be removed in a upcoming update resulting in non-functioning fax modem hardware on Windows.
Product: Microsoft Agere Modem driver
CVSS Score: 7.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24052ISC Diary: https://isc.sans.edu/diary/32368NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24052
CVE-2025-59230 – Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
Product: Microsoft Windows Remote Access Connection Manager
CVSS Score: 7.8
** KEV since 2025-10-14 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59230ISC Diary: https://isc.sans.edu/diary/32368NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59230
CVE-2016-7836 – SKYSEA Client View Ver.11.221.03 and earlier is vulnerable to remote code execution due to a flaw in processing authentication on the TCP connection.
Product: Skygroup Skysea_Client_View
CVSS Score: 0
** KEV since 2025-10-14 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-7836
CVE-2025-49708 – Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.
Product: Microsoft Graphics Component
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-49708ISC Diary: https://isc.sans.edu/diary/32368NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49708
CVE-2025-55315 – ASP.NET Core allows an authorized attacker to bypass a security feature over a network due to inconsistent interpretation of http requests.
Product: Microsoft ASP.NET Core
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-55315ISC Diary: https://isc.sans.edu/diary/32368NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315
CVE-2025-59287 – Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
Product: Microsoft Windows Server Update Service
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59287ISC Diary: https://isc.sans.edu/diary/32368NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
CVE-2025-0603 – Callvision Emergency Code before V3.0 is vulnerable to SQL Injection and Blind SQL Injection.
Product: Callvision Healthcare Callvision Emergency Code
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0603
NVD References: https://www.usom.gov.tr/bildirim/tr-25-0320
CVE-2025-25009 – Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.
Product: Kibana
CVSS Score: 8.7
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-25009
ISC Podcast: https://isc.sans.edu/podcastdetail/9646
NVD References: https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-20/382449
CVE-2025-52021 – PuneethReddyHC Online Shopping System Advanced 1.0 has a SQL Injection vulnerability in the edit_product.php file due to unsafe handling of the product_id GET parameter.
Product: PuneethReddyHC Online Shopping System Advanced 1.0
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-52021
CVE-2025-3450 – Improper Resource Locking vulnerability in B&R Industrial Automation Automation Runtime.This issue affects Automation Runtime: from 6.0 before 6.3, before Q4.93.
Product: B&R Industrial Automation Automation Runtime
CVSS Score: 10.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-3450
NVD References: https://www.br-automation.com/fileadmin/SA25P002-f6a69e61.pdf
CVE-2025-44823 – Nagios Log Server allows authenticated users to retrieve cleartext administrative API keys via a specific API call, GL:NLS#475.
Product: Nagios Log Server
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-44823
CVE-2025-11418 – Tenda CH22 up to 1.0.0.1 is vulnerable to a remote stack-based buffer overflow in function formWrlsafeset of the HTTP Request Handler component.
Product: Tenda CH22
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-11418
CVE-2025-11423 – Tenda CH22 1.0.0.1 is vulnerable to remote memory corruption due to improper handling of user input in the formSafeEmailFilter function within the /goform/SafeEmailFilter file.
Product: Tenda CH22
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-11423
CVE-2025-53967 – Framelink Figma MCP Server before 0.6.3 is vulnerable to remote command execution due to inadequate sanitization of input in HTTP POST requests.
Product: Framelink Figma MCP Server
CVSS Score: 8.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-53967
ISC Podcast: https://isc.sans.edu/podcastdetail/9648
CVE-2025-61913 – Flowise allows authenticated attackers to read and write arbitrary files to any path in the file system, potentially leading to remote command execution.
Product: Flowise
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61913
CVE-2025-11539 – Grafana Image Renderer is vulnerable to remote code execution through an arbitrary file write vulnerability, allowing an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process.
Product: Grafana grafana-image-renderer
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-11539
NVD References: https://grafana.com/security/security-advisories/cve-2025-11539/
CVE-2025-56683 – Logseq v0.10.9 is vulnerable to a cross-site scripting (XSS) attack in the /app/marketplace.html component, enabling arbitrary code execution by injecting malicious Javascript into a specially designed README.md file.
Product: Logseq v0.10.9
CVSS Score: 9.6
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-56683
CVE-2025-10283 – BBOT’s gitdumper module could be abused to execute commands through a malicious git repository.
Product: BBOT gitdumper module
CVSS Score: 9.6
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10283
CVE-2025-10284 – BBOT’s unarchive module is vulnerable to exploitation through malicious archive files, allowing for remote code execution via arbitrary file write.
Product: BBOT unarchive module
CVSS Score: 9.6
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10284
CVE-2025-59978 – Juniper Networks Junos Space is vulnerable to Cross-site Scripting, allowing an attacker to execute commands as an admin on affected versions before 24.1R4.
Product: Juniper Networks Junos Space
CVSS Score: 9.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59978
CVE-2025-60316 – SourceCodester Pet Grooming Management Software 1.0 is vulnerable to SQL Injection in admin/view_customer.php via the ID parameter.
Product: SourceCodester Pet Grooming Management Software
CVSS Score: 9.4
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-60316
CVE-2025-35050 – Newforma Info Exchange (NIX) vulnerability allows unauthenticated remote attackers to execute arbitrary code on the system with elevated privileges.
Product: Newforma Project Center Server
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-35050
CVE-2025-35051 – Newforma Project Center Server (NPCS) accepts serialized .NET data via the ‘/ProjectCenter.rem’ endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with ‘NT AUTHORITY\NetworkService’ privileges.
Product: Newforma Project Center Server (NPCS)
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-35051
CVE-2025-59218 – Azure Entra ID Elevation of Privilege Vulnerability
Product: Microsoft Azure Entra ID
CVSS Score: 9.6
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59218
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59218
CVE-2025-59246 – Azure Entra ID Elevation of Privilege Vulnerability
Product: Microsoft Azure Entra ID
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59246
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59246
CVE-2025-60269 – JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportExcelController.java file.
Product: JEEWMS 20250820
CVSS Score: 9.4
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-60269
CVE-2025-60306 – code-projects Simple Car Rental System 1.0 allows low privilege users to impersonate high privilege users and access sensitive information.
Product: code-projects Simple Car Rental System
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-60306
CVE-2025-61929 – Cherry Studio desktop client is vulnerable to remote code execution attacks when processing `cherrystudio://` URLs, allowing for potential compromise of user systems.
Product: Cherry Studio
CVSS Score: 9.6
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61929
CVE-2025-61884 – Oracle Configurator in Oracle E-Business Suite (Runtime UI component) versions 12.2.3-12.2.14 is vulnerable to an easily exploitable flaw allowing unauthorized access to critical data or complete control over all accessible data.
Product: Oracle E-Business Suite
CVSS Score: 7.5
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-61884
ISC Podcast: https://isc.sans.edu/podcastdetail/9652
NVD References: https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
CVE-2025-9976 – Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x is vulnerable to OS Command Injection, enabling attackers to run arbitrary code on the user’s system.
Product: 3DEXPERIENCE Station Launcher App
CVSS Score: 9.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-9976
CVE-2025-6919 – Aykome License Tracking System before Version dated 06.10.2025 is vulnerable to SQL Injection.
Product: Cats Information Technology Aykome License Tracking System
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-6919
CVE-2025-37729 – Elastic Cloud Enterprise (ECE) is vulnerable to data exfiltration and command execution by a malicious actor with Admin access through improperly neutralized special elements in its template engine.
Product: Elastic Elastic Cloud Enterprise (ECE)
CVSS Score: 9.1
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-37729
NVD References: https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-2-security-update-esa-2025-21/382641
CVE-2025-42910 – SAP Supplier Relationship Management is vulnerable to arbitrary file uploads, allowing attackers to potentially execute malicious code and significantly compromise system security.
Product: SAP Supplier Relationship Management
CVSS Score: 9.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-42910
CVE-2025-42937 – SAPSprint allows unauthenticated attackers to overwrite system files by traversing to parent directories, compromising confidentiality, integrity, and availability.
Product: SAP Print Service (SAPSprint)
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-42937
CVE-2025-46581 – ZTE’s ZXCDN product is susceptible to a Struts remote code execution vulnerability allowing unauthenticated attackers to execute commands remotely.
Product: ZTE ZXCDN
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-46581
CVE-2025-40765 – TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3) is vulnerable to an information disclosure flaw that allows unauthenticated remote attackers to access password hashes and perform authenticated actions in the database service.
Product: TeleControl Server Basic V3.1
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-40765
NVD References: https://cert-portal.siemens.com/productcert/html/ssa-062309.html
CVE-2025-40771 – SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543SP-1, SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, SIPLUS ET 200SP CP 1543SP-1 ISEC, and SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL devices are vulnerable to unauthorized configuration data access due to a lack of proper authentication.
Product: Siemens SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543SP-1, SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, SIPLUS ET 200SP CP 1543SP-1 ISEC, SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-40771
NVD References: https://cert-portal.siemens.com/productcert/html/ssa-486936.html
CVE-2025-10610 – Winsure allows Blind SQL Injection through Version dated 21.08.2025.
Product: SFS Consulting Information Processing Industry and Foreign Trade Inc. Winsure
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10610
CVE-2025-49553 – Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability allowing attackers to execute malicious scripts in a victim’s browser.
Product: Adobe Connect
CVSS Score: 9.3
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-49553
NVD References: https://helpx.adobe.com/security/products/connect/apsb25-70.html
CVE-2025-11371 – Gladinet CentreStack and TrioFox versions prior to 16.7.10368.56560 have an unauthenticated Local File Inclusion Flaw allowing for disclosure of system files.
Product: Gladinet CentreStack
CVSS Score: 6.2
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-11371
ISC Podcast: https://isc.sans.edu/podcastdetail/9652
NVD References: https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw
CVE-2025-59489 – Unity Runtime before 2025-10-02 allows argument injection on Android, Windows, macOS, and Linux, potentially enabling remote code execution and information exfiltration.
Product: Unity Runtime
CVSS Score: 0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-59489
ISC Diary: https://isc.sans.edu/diary/32368
CVE-2025-0785 – ESAFENET CDG V5 has a cross-site scripting vulnerability in the /SysConfig.jsp file that can be exploited remotely and has been publicly disclosed.
Product: ESAFENET CDG V5
CVSS Score: 0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-0785
ISC Diary: https://isc.sans.edu/diary/32364
CVE-2025-10586 & CVE-2025-10587 – The Community Events plugin for WordPress SQL Injection vulnerabilities
Product: WordPress Community Events plugin
Active Installations: 40+
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10586
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10587
NVD References:
– https://www.wordfence.com/threat-intel/vulnerabilities/id/92f3b923-884e-4f61-9bf8-62dfb267a27e?source=cve
– https://www.wordfence.com/threat-intel/vulnerabilities/id/f8a54a18-64e2-4046-8143-2b5116c4200b?source=cve
CVE-2025-7526 & CVE-2025-7634 – The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress vulnerabilities
Active Installations: 20,000+
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-7526
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-7634
NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/c754d957-26a8-4fef-a487-96d566c2dc36?source=cve
NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/ce119965-01a0-4cff-a0b2-e99bceb1406c?source=cve
CVE-2025-11522 – The Search & Go – Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover allowing unauthenticated attackers to gain access to other user’s accounts when Facebook login is enabled.
Product: Edge Themes Search & Go – Directory WordPress Theme
Active Installations: Unknown. Update to version 2.8, or a newer patched version.
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-11522
NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/da590a65-8728-4577-b6e4-ecebc2a2277d?source=cve
CVE-2025-11533 – The WP Freeio plugin for WordPress allows unauthenticated attackers to register as administrators due to a privilege escalation vulnerability.
Product: WordPress WP Freeio plugin
Active Installations: Unknown. Update to version 1.2.22, or a newer patched version,
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-11533
NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/0db85f84-04e9-42eb-a16b-96554fbfd186?source=cve
CVE-2025-6553 – The Ovatheme Events Manager plugin for WordPress allows unauthenticated attackers to upload arbitrary files and potentially execute remote code due to missing file type validation in older versions up to 1.8.5.
Product: Ovatheme Events Manager plugin for WordPress
Active Installations: Unknown. Update to version 1.8.6, or a newer patched version.
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-6553NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/808392a9-dbac-4896-8677-6ddc1213d80d?source=cve
CVE-2025-6439 – The WooCommerce Designer Pro plugin for WordPress allows unauthenticated attackers to delete files on the server, leading to potential remote code execution, data loss, or site unavailability.
Product: WooCommerce Designer Pro plugin
Active Installations: Unknown. No known patch available.
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-6439NVD References: https://www.wordfence.com/threat-intel/vulnerabilities/id/407a0bc3-2775-4a34-9817-924bf94a4f94?source=cve
The following vulnerabilities need a manual review:
CVE-2025-54957 – Integer overflow in Dolby Digital Plus audio decoder ISC Diary: https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+October+2025/32368/
CVE-2025-11001 & CVE-2025-11002 – 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerabilities References:
– https://www.zerodayinitiative.com/advisories/ZDI-25-949/– https://www.zerodayinitiative.com/advisories/ZDI-25-950/