Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-52999 State: PUBLISHED Published: 2025-06-25T17:02:57.428Z Last Updated: 2025-06-25T18:04:23.296Z Vendors: FasterXML Products: jackson-core Problem Types: CWE-121 Description: jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsExceptio
erse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3 - https://github.com/FasterXML/jackson-core/pull/943
CVE ID: CVE-2025-53001 State: REJECTED Published: N/A Last Updated: 2025-06-30T15:39:53.377Z Description: No description available.
CVE ID: CVE-2025-53002 State: PUBLISHED Published: 2025-06-26T14:40:52.764Z Last Updated: 2025-06-26T15:12:51.382Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: hiyouga Products: LLaMA-Factory Problem Types: CWE-94, CWE-502 Description: LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including 0.9.3 during the LLaMA-Factory training process. This vulnerability arises because the `vhead_file` is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passing a malicious `Checkpoint path`
icious attackers to execute arbitrary malicious code on the host system simply by passing a malicious `Checkpoint path` parameter through the `WebUI` interface. The attack is stealthy, as the victim remains unaware of the exploitation. The root cause is that the `vhead_file` argument is loaded without the secure parameter `weights_only=True`. Version 0.9.4 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hiyouga/LLaMA-Factory/security/advisories/GHSA-xj56-p8mm-qmxj - https://github.com/hiyouga/LLaMA-Factory/commit/bb7bf51554d4ba8432333c35a5e3b52705955ede - https://drive.google.com/file/d/1AddKm2mllsXfuvL4Tvbn_WJdjEOYXx4y/view?u
mmit/bb7bf51554d4ba8432333c35a5e3b52705955ede - https://drive.google.com/file/d/1AddKm2mllsXfuvL4Tvbn_WJdjEOYXx4y/view?usp=sharing
CVE ID: CVE-2025-53003 State: PUBLISHED Published: 2025-07-01T01:22:05.855Z Last Updated: 2025-07-01T13:34:32.703Z Vendors: JanssenProject Products: jans Problem Types: CWE-200, CWE-269, CWE-284 Description: The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verification. This has a large internal surface attack area that exposes all sorts of information from the IDP including clients, users, scripts ..etc. This issue has been patched in version 1.8.0. A workaround for this vulnerability involves users forking and building the config api, patching it in their system following commit 92eea4d
s vulnerability involves users forking and building the config api, patching it in their system following commit 92eea4d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JanssenProject/jans/security/advisories/GHSA-373j-mhpf-84wg - https://github.com/JanssenProject/jans/issues/11575 - https://github.com/JanssenProject/jans/commit/92eea4d4637f1cae16ad2f07b2c16378ff3fc5f1 - https://github.com/JanssenProject/jans/releases/tag/v1.8.0
CVE ID: CVE-2025-53004 State: PUBLISHED Published: 2025-06-30T20:18:49.563Z Last Updated: 2025-07-01T00:33:13.050Z Vendors: dataease Products: dataease Problem Types: CWE-153 Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's Redshift Data Source JDBC Connection Parameters. The sslfactory and sslfactoryarg parameters could trigger a bypass vulnerability. This issue has been patched in version 2.10.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-mfg2-qr5c-99pp
CVE ID: CVE-2025-53005 State: PUBLISHED Published: 2025-07-01T00:33:53.963Z Last Updated: 2025-07-01T13:38:07.211Z Vendors: dataease Products: dataease Problem Types: CWE-153 Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's PostgreSQL Data Source JDBC Connection Parameters. The sslfactory and sslfactoryarg parameters could trigger a bypass vulnerability. This issue has been patched in version 2.10.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-99c4-h4fq-r23v
CVE ID: CVE-2025-53006 State: PUBLISHED Published: 2025-07-02T14:22:31.107Z Last Updated: 2025-07-02T14:37:30.510Z Vendors: dataease Products: dataease Problem Types: CWE-153 Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassNam
ection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-q726-5pr9-x7gm
CVE ID: CVE-2025-53007 State: PUBLISHED Published: 2025-06-26T14:45:40.839Z Last Updated: 2025-06-27T16:09:37.079Z Vendors: espressif Products: arduino-esp32 Problem Types: CWE-113 Description: arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response Splitting vulnerability. The `sendHeader` function takes arbitrary input for the HTTP header name and value, concatenates them into an HTTP header line, and appends this to the outgoing HTTP response headers. There is no validation or sanitization of the `name` or `value` parameters before they are included in the HTTP response. If an attacker can control the input to `sendHeader` (eithe
e` parameters before they are included in the HTTP response. If an attacker can control the input to `sendHeader` (either directly or indirectly), they could inject carriage return (`\r`) or line feed (`\n`) characters into either the header name or value. This could allow the attacker to inject additional headers, manipulate the structure of the HTTP response, potentially inject an entire new HTTP response (HTTP Response Splitting), and/or ause header confusion or other HTTP protocol attacks. Versions 3.3.0-RC1 and 3.2.1 contain a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espressif/arduino-esp32/security/advisories/GHSA-5476-9jjq-
s: - CISA ADP Vulnrichment: References: - https://github.com/espressif/arduino-esp32/security/advisories/GHSA-5476-9jjq-563m - https://github.com/espressif/arduino-esp32/commit/21640ac82a1bb5efa8cf0b3841be1ac80add6785 - https://github.com/espressif/arduino-esp32/blob/9e61fa7e4bce59c05cb17c15b11b53b9bafca077/libraries/WebServer/src/WebServer.cpp#L504-L521 - https://github.com/espressif/arduino-esp32/blob/9e61fa7e4bce59c05cb17c15b11b53b9bafca077/libraries/WebServer/src/WebServer.cpp#L577-L582
CVE ID: CVE-2025-53008 State: PUBLISHED Published: 2025-07-30T14:09:58.592Z Last Updated: 2025-07-30T19:28:38.917Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-522 Description: GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.3.1 through 10.0.19, a connected user can use a malicious payload to steal mail receiver credentials. This is fixed in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/g
d in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-52h8-76ph-4j9q
CVE ID: CVE-2025-53009 State: PUBLISHED Published: 2025-08-01T17:57:56.221Z Last Updated: 2025-08-01T18:22:16.665Z Vendors: AcademySoftwareFoundation Products: MaterialX Problem Types: CWE-121 Description: MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3. Additional Analyst Notes: - CISA ADP Vulnri
s OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822 - https://github.com/AcademySoftwareFoundation/MaterialX/issues/2504 - https://github.com/AcademySoftwareFoundation/MaterialX/pull/2505 - https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3 - https://github.com/ShielderSec/poc/tree/main/CVE-2025-53009
CVE ID: CVE-2025-53010 State: PUBLISHED Published: 2025-08-01T17:58:28.994Z Last Updated: 2025-08-01T18:19:33.225Z Vendors: AcademySoftwareFoundation Products: MaterialX Problem Types: CWE-476 Description: MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3. Additional Analyst Notes: - CISA ADP Vulnrichme
enEXR by sending a malicious MTLX file. This is fixed in version 1.39.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-3jhf-gxhr-q4cx - https://github.com/AcademySoftwareFoundation/MaterialX/commit/e13344ba13326869d7820b444705f24d56fab73d - https://github.com/ShielderSec/poc/tree/main/CVE-2025-53010
CVE ID: CVE-2025-53011 State: PUBLISHED Published: 2025-08-01T17:58:47.388Z Last Updated: 2025-08-01T18:16:36.719Z Vendors: AcademySoftwareFoundation Products: MaterialX Problem Types: CWE-476 Description: MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. An attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file. This is fixed in version 1.39.3. Additional Analyst Notes: - CISA ADP Vulnrich
terialX by sending a malicious MTLX file. This is fixed in version 1.39.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-7qw8-3vmf-gj32 - https://github.com/AcademySoftwareFoundation/MaterialX/commit/7ac1c71de5187dc29793292b5a8dc6d784192ecf - https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3 - https://github.com/ShielderSec/poc/tree/main/CVE-2025-53011
CVE ID: CVE-2025-53012 State: PUBLISHED Published: 2025-08-01T18:00:39.115Z Last Updated: 2025-08-01T19:04:41.209Z Vendors: AcademySoftwareFoundation Products: MaterialX Problem Types: CWE-400 Description: MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. When parsing file imports, recursion is used to process nested files; however, there is no limit imposed to the depth of files that can be parsed by the library. By building a sufficiently deep chain of Mater
no limit imposed to the depth of files that can be parsed by the library. By building a sufficiently deep chain of MaterialX files one referencing the next, it is possible to crash the process using the MaterialX library via stack exhaustion. This is fixed in version 1.39.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-qc2h-74x3-4v3w - https://github.com/AcademySoftwareFoundation/MaterialX/pull/2233/commits/6182c07467297416a30d148ab531d81198686dc5 - https://github.com/AcademySoftwareFoundation/MaterialX/blob/main/documents/Specification/MaterialX.Specification.md#mtlx-file-format-definition -
SoftwareFoundation/MaterialX/blob/main/documents/Specification/MaterialX.Specification.md#mtlx-file-format-definition - https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3
CVE ID: CVE-2025-53013 State: PUBLISHED Published: 2025-06-26T18:02:31.828Z Last Updated: 2025-08-20T19:29:16.720Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: himmelblau-idm Products: himmelblau Problem Types: CWE-287 Description: Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an *invalid* Linux Hello PIN, provided the host is offline. While the user gains access to the local system, Single Sign-On (SSO) fails due to the network being down and the inability to issue tokens (due to a failure to unlo
em, Single Sign-On (SSO) fails due to the network being down and the inability to issue tokens (due to a failure to unlock the Hello key). The core issue lies in an incorrect assumption within the `acquire_token_by_hello_for_business_key` function: it was expected to return a `TPMFail` error for an invalid Hello key when offline, but instead, a preceding nonce request resulted in a `RequestFailed` error, leading the system to erroneously transition to an offline success state without validating the Hello key unlock. This impacts systems using Himmelblau for authentication when operating in an offline state with Hello PIN authentication enabled. Rocky Linux 8 (and variants) are not affected b
hen operating in an offline state with Hello PIN authentication enabled. Rocky Linux 8 (and variants) are not affected by this vulnerability. The problem is resolved in Himmelblau version 0.9.17. A workaround is available for users who cannot immediately upgrade. Disabling Hello PIN authentication by setting `enable_hello = false` in `/etc/himmelblau/himmelblau.conf` will mitigate the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-j93j-pwm6-p97j - https://github.com/himmelblau-idm/himmelblau/commit/64b03739f1d5ee472b1cff3ed20ed9af1c65a6f8 - https://github.com/himmel
https://github.com/himmelblau-idm/himmelblau/commit/64b03739f1d5ee472b1cff3ed20ed9af1c65a6f8 - https://github.com/himmelblau-idm/himmelblau/commit/78477d684df710d57c10091c87b92665cfac98ae
CVE ID: CVE-2025-53014 State: PUBLISHED Published: 2025-07-14T17:59:25.533Z Last Updated: 2025-11-03T18:13:09.280Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-125, CWE-193 Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue. Additional Analyst
t strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f
CVE ID: CVE-2025-53015 State: PUBLISHED Published: 2025-07-14T19:31:27.548Z Last Updated: 2025-07-15T13:14:23.716Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-835 Description: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g - https://drive.google.com/file/d/1iegkwlTjqnJTt
hub.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g - https://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing
CVE ID: CVE-2025-53017 State: REJECTED Published: N/A Last Updated: 2025-06-30T15:39:09.449Z Description: No description available.
CVE ID: CVE-2025-53018 State: PUBLISHED Published: 2025-06-27T13:00:14.086Z Last Updated: 2025-06-27T13:58:56.661Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: LycheeOrg Products: Lychee Problem Types: CWE-918 Description: Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose. Consequently, internal network resources—such as localhost services or cloud-provider metadata endpoints—become reachable. The endpoint takes a URL fr
resources—such as localhost services or cloud-provider metadata endpoints—become reachable. The endpoint takes a URL from the user and calls it server-side via fopen() without any safeguards. There is no IP address validation, nor are there any allow-list, timeout, or size restrictions. Because of this, attackers can point the application at internal targets. Using this flaw, an attacker can perform internal port scans or retrieve sensitive cloud metadata. Version 6.6.13 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-cpgw-wgf3-xc6v - https://github.com/LycheeOrg/Lychee/commit/9dc16
//github.com/LycheeOrg/Lychee/security/advisories/GHSA-cpgw-wgf3-xc6v - https://github.com/LycheeOrg/Lychee/commit/9dc162eefe56ce185ac1d59da42ee557933d914d
CVE ID: CVE-2025-53019 State: PUBLISHED Published: 2025-07-14T19:42:49.591Z Last Updated: 2025-11-03T18:13:10.222Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-125 Description: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/
the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc
CVE ID: CVE-2025-53020 State: PUBLISHED Published: 2025-07-10T16:59:06.340Z Last Updated: 2025-11-04T21:11:43.692Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-401 Description: Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html
CVE ID: CVE-2025-53021 State: PUBLISHED Published: 2025-06-24T00:00:00.000Z Last Updated: 2025-06-24T19:46:49.641Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Moodle Products: Moodle Problem Types: CWE-384 Description: A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x
ation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rentry.co/moodle-oauth2-cve - https://github.com/moodle/moodle/releases/tag/v3.11.18 - https://moodledev.io/general/releases#moodle-311
CVE ID: CVE-2025-53022 State: PUBLISHED Published: 2025-07-30T00:00:00.000Z Last Updated: 2025-07-30T19:50:36.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While processing a new image, the Firmware Upgrade (FWU) module does not validate the length field of the Type-Length-Value (TLV) structure for dependent components against the maximum allowed size. If the length specified in the TLV exceeds the size of the buffer allocated on the stack, the FWU module will overwrite the buffer (and potentially other stack data) with the T
he buffer allocated on the stack, the FWU module will overwrite the buffer (and potentially other stack data) with the TLV's value content. An attacker could exploit this by crafting a malicious TLV entry in the unprotected section of the MCUBoot upgrade image. By setting the length field to exceed the expected structure size, the attacker can manipulate the stack memory of the system during the upgrade process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.trustedfirmware.org/projects/tf-m/ - https://git.trustedfirmware.org/plugins/gitiles/TF-M/trusted-firmware-m.git/+/refs/heads/main/secure_fw/partitions/firmware_update/bootloader/mcuboot/tfm_mcuboot_fwu.c#25
-M/trusted-firmware-m.git/+/refs/heads/main/secure_fw/partitions/firmware_update/bootloader/mcuboot/tfm_mcuboot_fwu.c#257 - https://trustedfirmware-m.readthedocs.io/en/latest/security/security_advisories/fwu_tlv_payload_out_of_bounds_vulnerability.html