CVE-2025-10458
Parameters are not validated or sanitized, and are later used in various internal operations.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.6
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- EPSS probability
- 0.21%
- CWE
- CWE-130
- Published
- 2025-09-19
- Last modified
- 2026-03-12
Affected products
- zephyrproject-rtos Zephyr
Weakness type
Related vulnerabilities
- CVE-2026-71337 — Windows Storage Management Provider Elevation of Privilege Vulnerability
- CVE-2026-5706 — Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements
- CVE-2026-71402 — wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length
- CVE-2026-81575 — Missing Sanity Checks for Buffer Lengths
- CVE-2026-58097 — ppp(8): missing length validation in mp_SetEnddisc()
- CVE-2026-58096 — ppp(8): missing length validation in LcpDecodeConfig()
- CVE-2026-14587 — Unathenticated connection can hold Bolt channel open
- CVE-2026-67292 — FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure