CVE-2025-0509CWE-552

Signing Checks Bypass

High · published February 4, 2025

CVSS v3.1
7.3
EPSS
1%
Percentile
59.4
In the wild
Unconfirmed
What it is

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00904 · 59.4th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2025-02-04T20:01Z
EPSS history
Timeline
  • 04 FEB 20:01Z
    Signing Checks Bypass
    cvelistv5