CVE-2025-54566 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.2 MEDIUM	ADJACENT_NETWORK	HIGH	NONE	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 15.09%

Affected Products (NVD)

Vendor	Product	Version
qemu	qemu	𝑥 ≤ 10.0.3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

qemu

bookworm	1:7.2+dfsg-7+deb12u18 fixed
bookworm (security)	1:7.2+dfsg-7+deb12u15 fixed
bullseye	not-affected
forky	1:11.1.1+ds-1 fixed
sid	1:11.1.2+ds-1 fixed
trixie	1:10.0.13+ds-0+deb13u1 fixed
trixie (security)	1:10.0.2+ds-2+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

qemu

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
plucky	not-affected
trusty	not-affected
xenial	not-affected

Common Weakness Enumeration

CWE-642 - External Control of Critical State Data
The software stores security-critical state information about its users, or the software itself, in a location that is accessible to unauthorized actors.

References

https://lore.kernel.org/qemu-devel/20250713-wmask-v1-1-4c744cdb32c0@rsg.ci.i.u-tokyo.ac.jp/