CVE-2025-9557CWE-120

CVE-2025-9557

High · published November 26, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

⚡ An out-of-bounds write can open the door to arbitrary code execution! Even devices with memory protection aren’t safe from crashing and causing denial of service. 🔥 Think of it like a waiter accidentally serving a dish meant for another table — the wrong order isn’t just a mix-up; it can mess up the entire dining experience! If exploited, an attacker can run malicious code on the affected device, potentially leading to crashes that disrupt services and leave users hanging. This could be absolutely devastating for systems relying on stability, causing data loss and service outages!

Put simply

Think of it like a waiter accidentally serving a dish meant for another table — the wrong order isn’t just a mix-up; it can mess up the entire dining experience! This vulnerability allows an attacker to overwrite memory outside the intended boundaries, leading to arbitrary code execution. Even with memory protection measures in place, it can result in a system crash and denial of service.

What to do

If exploited, an attacker can run malicious code on the affected device, potentially leading to crashes that disrupt services and leave users hanging. This could be absolutely devastating for systems relying on stability, causing data loss and service outages! To mitigate this risk, ensure your systems are updated with the latest patches once they become available. Review your software configurations to minimize exposure to potential exploitation. Staying proactive is key to maintaining security! You can tackle this vulnerability head-on! By following these steps, you’ll be bolstering your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00208 · 10.3th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-11-26T11:15Z
References (1)
EPSS history
Timeline
  • 26 NOV 05:43Z
    Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont
    cvelistv5