CVE-2025-65117CWE-676

AVEVA Process Optimization Use of Potentially Dangerous Function

High · published January 16, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

⚡ A crafty Process Optimization Designer User can embed OLE objects into graphics, potentially granting them the power to impersonate any victim user who interacts with those graphics! Think of it like a sneaky magician slipping a trapdoor into an illusion. Once someone steps into the show, they unwittingly activate that trapdoor and fall right into the magician's controlled act, unaware of how vulnerable they really are. This vulnerability is a high-stakes game: an attacker could elevate their privileges, gaining access to sensitive actions and data as if they were the victim. Imagine the chaos if a malicious actor could execute actions on behalf of trusted users, potentially leading to data breaches or unauthorized changes. It’s absolutely devastating!

Put simply

Think of it like a sneaky magician slipping a trapdoor into an illusion. Once someone steps into the show, they unwittingly activate that trapdoor and fall right into the magician's controlled act, unaware of how vulnerable they really are. This vulnerability allows authenticated users to insert malicious OLE objects into graphics, enabling privilege escalation when other users interact with those graphics. Simply put, the malicious code can leverage the trust of a victim user to perform unauthorized actions.

What to do

This vulnerability is a high-stakes game: an attacker could elevate their privileges, gaining access to sensitive actions and data as if they were the victim. Imagine the chaos if a malicious actor could execute actions on behalf of trusted users, potentially leading to data breaches or unauthorized changes. It’s absolutely devastating! To mitigate this risk, ensure that your application is updated to the latest version with the necessary security patches. Additionally, review user permissions carefully and educate all users about the dangers of interacting with unexpected or untrusted graphic content. Vigilance is key! You've got this! By taking action now, you're stepping up to fortify your defenses and keep the internet safer! 🛡️

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
EPSS
0.00221 · 12.0th percentile
Weakness
CWE-676 · Use of Potentially Dangerous Function
Published
2026-01-16T00:14Z
EPSS history
Timeline
  • 16 JAN 00:14Z
    AVEVA Process Optimization Use of Potentially Dangerous Function
    cvelistv5