CVE-2025-39757
highpriority · track · 28EPSS 0.002 · 7 %ileDEEUNLRUUSEPSS · scored 2026-10-27
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIMATIC CN 4100siemens_psirt
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/ - FixedSIMATIC CN 4100cisa_csaf_ot
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.5–7.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (124)
Products and version ranges known to be affected.
advisories (5)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0147Kwetsbaarheden verholpen in Siemens-productenNL2026-05-13csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in verschillende (OT-)producten. Het gaat onder andere om producten in de Siemens RUGGEDCOM-, SCALANCE-, SIMATIC-, SIMIT-, SINAMICS-, SIPROTEC-, SENTRON- en Solid Edge-productreeksen.
- SSA-032379SSA-032379: Multiple Vulnerabilities in SIMATIC CN 4100 Before V5.02026-05-12csaf · siemens_psirtDE
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
- WID-SEC-W-2025-2040Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2025-09-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um Sicherheitsmechanismen zu umgehen, sowie einen Denial of Service Angriff oder andere nicht spezifizierte Angriffe durchzuführen.
- WID-SEC-W-2026-0349Dell Avamar und NetWorker: Mehrere SchwachstellenDeutsch2026-02-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Avamar und Dell NetWorker ausnutzen, um Angriffe zu starten, die die Integrität, Vertraulichkeit und Verfügbarkeit von Systemen beeinträchtigen.
- ICSA-26-134-10Siemens SIMATIC2026-05-12icsa · cisa_csaf_otUS
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (32)
External citations — patches, advisories, analysis.
- https://git.kernel.org/stable/c/1034719fdefd26caeec0a44a868bb5a412c2c1a5cnnvd
- https://git.kernel.org/stable/c/275e37532e8ebe25e8a4069b2d9f955bfd202a46cnnvd
- https://git.kernel.org/stable/c/47ab3d820cb0a502bd0074f83bb3cf7ab5d79902cnnvd
- https://git.kernel.org/stable/c/786571b10b1ae6d90e1242848ce78ee7e1d493c4cnnvd
- https://git.kernel.org/stable/c/799c06ad4c9c790c265e8b6b94947213f1fb389ccnnvd
- https://git.kernel.org/stable/c/7ef3fd250f84494fb2f7871f357808edaa1fc6cecnnvd
- https://git.kernel.org/stable/c/ae17b3b5e753efc239421d186cd1ff06e5ac296ecnnvd
- https://git.kernel.org/stable/c/dfdcbcde5c20df878178245d4449feada7d5b201cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan