CVE-2025-0509

mediumpriority · track · 27EPSS 0.009 · 60 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.90% (60th) EPSS

CVSS 6.8 · medium

Is it mine?

43 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

cvss

Technical severity, 0–10. One row per scoring source.

7.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.2–7.3

v3.16.8mediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 0.9 · impact 5.9

v3.17.3highAV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.3highCVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.3highCVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:Hsecondary · patrick@puiterwijk.orgexploitability 0.7 · impact 6

v3.17.3highCVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:Hsecondary · OSV

v3.16.2mediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-552USCWE-552USCWE-552US

affected products (43)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Azul Zuluall versionscert_bundDEcpe:/a:azul:zulu:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Dell Avamarall versionscert_bundDEcpe:/a:dell:avamar:-
Dell NetWorker virtualall versionscert_bundDEcpe:/a:dell:networker:virtual
HCL BigFix <11.0.4.0all versionscert_bundDE
Hitachi Command Suiteall versionscert_bundDEcpe:/a:hitachi:command_suite:-
Hitachi Configuration Managerall versionscert_bundDEcpe:/a:hitachi:configuration_manager:-
Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
NetApp ActiveIQ Unified Managerall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:-
Open Source OpenJDKall versionscert_bundDEcpe:/a:oracle:openjdk:-
Oracle GraalVM Enterprise Edition 20.3.16all versionscert_bundDEcpe:/a:oracle:graalvm:20.3.16::enterprise_edition
Oracle GraalVM Enterprise Edition 21.3.12all versionscert_bundDEcpe:/a:oracle:graalvm:21.3.12::enterprise_edition
Oracle GraalVM for JDK 17.0.13all versionscert_bundDEcpe:/a:oracle:graalvm:17.0.13::for_jdk
Oracle GraalVM for JDK 21.0.5all versionscert_bundDEcpe:/a:oracle:graalvm:21.0.5::for_jdk
Oracle GraalVM for JDK 23.0.1all versionscert_bundDEcpe:/a:oracle:graalvm:23.0.1::for_jdk
Oracle Java SE 11.0.25all versionscert_bundDEcpe:/a:oracle:java_se:11.0.25
Oracle Java SE 17.0.13all versionscert_bundDEcpe:/a:oracle:java_se:17.0.13
Oracle Java SE 21.0.5all versionscert_bundDEcpe:/a:oracle:java_se:21.0.5

showing 20 of 43

advisories (5)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-0140Oracle Java SE: Mehrere SchwachstellenDeutsch2025-01-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-wc9m-r3v6-9p5hSparkle Signing Checks Bypass2025-02-04ghsa · osvUS
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
BIT-java-2025-0509Signing Checks Bypass2026-05-06vendor · osvUS
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
BIT-java-min-2025-0509Signing Checks Bypass2026-05-06vendor · osvUS
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
BIT-jre-2025-0509Signing Checks Bypass2026-05-08vendor · osvUS
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

also known as (8)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund NVD CVE.org MITRE

published 2025-02-04modified 2026-06-17

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan