CVE-2025-59319

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matching a hardcoded type value. A crafted Linux partition could be inserted ahead of this intended target, allowing for code execution in the context of high privilege.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://i.blackhat.com/BH-USA-26/Presentations/US-26-Burch-The-Cost-of-Obscurity-Wednesday.pdf
https://i.blackhat.com/BH-USA-26/Presentations/US-26-Burch-The-Cost-of-Obscurity-wp.pdf
https://www.cpsd.at/blog/

Configurations

No configuration.

History

29 Sep 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) CPSD CryptoPro Secure Disk para Bitlocker anterior a la v7.7.4 no logra certificar la integridad de la partición de arranque prevista y selecciona el primer índice de partición que coincide con un valor de tipo codificado de forma rígida. Una partición Linux manipulada podría insertarse antes de este objetivo previsto, permitiendo la ejecución de código en el contexto de altos privilegios.

Information

Published : 2026-08-12 15:17

Updated : 2026-09-29 11:10

NVD link : CVE-2025-59319

Mitre link : CVE-2025-59319

CVE.ORG link : CVE-2025-59319

JSON object : View

Products Affected

No product.

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2025-59319", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59319", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T19:23:36.403791Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-08-12T15:17:28.963", "references": [{"url": "https://i.blackhat.com/BH-USA-26/Presentations/US-26-Burch-The-Cost-of-Obscurity-Wednesday.pdf", "source": "cve@mitre.org"}, {"url": "https://i.blackhat.com/BH-USA-26/Presentations/US-26-Burch-The-Cost-of-Obscurity-wp.pdf", "source": "cve@mitre.org"}, {"url": "https://www.cpsd.at/blog/", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matching a hardcoded type value. A crafted Linux partition could be inserted ahead of this intended target, allowing for code execution in the context of high privilege."}, {"lang": "es", "value": "CPSD CryptoPro Secure Disk para Bitlocker anterior a la v7.7.4 no logra certificar la integridad de la partici\u00f3n de arranque prevista y selecciona el primer \u00edndice de partici\u00f3n que coincide con un valor de tipo codificado de forma r\u00edgida. Una partici\u00f3n Linux manipulada podr\u00eda insertarse antes de este objetivo previsto, permitiendo la ejecuci\u00f3n de c\u00f3digo en el contexto de altos privilegios."}], "lastModified": "2026-09-29T11:10:00.150", "sourceIdentifier": "cve@mitre.org"}