Multiple vulnerabilities in IBM QRadar SIEM

1) Improper Encoding or Escaping of Output

EUVDB-ID: #VU112731

Risk: High

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-47252

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

Exploit availability: No

The vulnerability allows a remote attacker to manipulate data in log files. 

The vulnerability exists due to improper input validation in mod_ssl. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files. A remote attacker can manipulate contents of log files. 

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU111900

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-5318

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the sftp_handle() function. A remote user can trigger an out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper locking

EUVDB-ID: #VU113277

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38461

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the EXPORT_SYMBOL_GPL() and vsock_assign_transport() functions in net/vmw_vsock/af_vsock.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper privilege management

EUVDB-ID: #VU113806

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38498

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

The vulnerability allows a local user to read and manipulate data.

The vulnerability exists due to improperly imposed permissions within the do_change_type() function in fs/namespace.c. A local user can read and manipulate data.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU114254

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38556

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the snto32() function in drivers/hid/hid-core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Path traversal

EUVDB-ID: #VU117681

Risk: High

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2025-55752

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: Yes

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences passed via Rewrite Valve. A remote attacker can send a specially crafted HTTP PUT request and write arbitrary files to the server, leading to remote code execution. 

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

7) Resource exhaustion

EUVDB-ID: #VU117682

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-61795

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling errors while processing multipart upload. Depending on JVM settings, application memory usage and application load, it is possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Security features bypass

EUVDB-ID: #VU112730

Risk: Medium

CVSSv4.0: 2.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2025-23048

CWE-ID: CWE-254 - Security Features

Exploit availability: Yes

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to access control bypass with session resumption in mod_ssl. A remote attacker can use the TLS 1.3 session resumption to bypass implemented access control.

Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

9) NULL pointer dereference

EUVDB-ID: #VU112994

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-32990

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when the certtool program is invoked with a template file with a number of string pairs for a single keyword. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Resource management error

EUVDB-ID: #VU112729

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-49630

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources in mod_proxy_http2. A remote attacker can send specially crafted requests to the server and perform a denial of service (DoS) attack.

Successful exploitation of the vulnerability requires that the reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Cryptographic issues

EUVDB-ID: #VU112728

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-49812

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to he way certain mod_ssl configurations handle TLS upgrades. A remote attacker can launch an HTTP desynchronisation attack, which allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.

Note, only configurations using "SSLEngine optional" to enable TLS upgrades are affected.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU115898

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-53373

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the seqiv_aead_encrypt_complete2() function in crypto/seqiv.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Out-of-bounds read

EUVDB-ID: #VU115415

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-39757

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the convert_chmap_v3() and snd_usb_get_audioformat_uac3() functions in sound/usb/stream.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Improper neutralization of wildcards or matching symbols

EUVDB-ID: #VU108768

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-47619

CWE-ID: CWE-155 - Improper Neutralization of Wildcards or Matching Symbols

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists within the tls_wildcard_match() function when handling host names with wildcards. A remote attacker can bypass expected security restrictions.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) NULL pointer dereference

EUVDB-ID: #VU112995

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-6395

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when a TLS 1.3 handshake involves a Hello Retry Request and the second Client Hello omits the PSK which was present in the first Client Hello. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Double free

EUVDB-ID: #VU112993

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-32988

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when exporting a certificate with an otherName in the SAN (subject alternative name) extension. A remote attacker can trick the victim into export a specially crafted certificate, trigger a double free error on the ASN.1 structure and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Improper locking

EUVDB-ID: #VU114833

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38718

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the sctp_rcv() function in net/sctp/input.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Use-after-free

EUVDB-ID: #VU114133

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38527

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cifs_oplock_break() and cifs_put_tlink() functions in fs/smb/client/file.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Input validation error

EUVDB-ID: #VU114967

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-39730

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the nfs_fh_to_dentry() function in fs/nfs/export.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Use-after-free

EUVDB-ID: #VU111421

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-50087

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the scpi_init_versions() and scpi_probe() functions in drivers/firmware/arm_scpi.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Buffer overflow

EUVDB-ID: #VU107793

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22026

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the nfsd_show() function in fs/nfsd/stats.c, within the nfsd_net_init() function in fs/nfsd/nfsctl.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Input validation error

EUVDB-ID: #VU108391

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37797

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the hfsc_change_class() function in net/sched/sch_hfsc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Out-of-bounds read

EUVDB-ID: #VU111484

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49985

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the record_func_key() function in kernel/bpf/verifier.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper access control

EUVDB-ID: #VU116185

Risk: High

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2025-41244

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the virtual machine. 

The vulnerability exists due to improper access restrictions. A local non-privileged user on the virtual machine can execute arbitrary  code with superuser privileges on the same virtual machine. 

Note, the vulnerability is being exploited in the wild since mid-October 2024.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

25) Race condition

EUVDB-ID: #VU113313

Risk: High

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2025-38352

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the run_posix_cpu_timers() function in kernel/time/posix-cpu-timers.c. A local user can escalate privileges on the system.

Note, the vulnerability is being actively exploited in the wild against Android devices.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

26) Memory leak

EUVDB-ID: #VU108411

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-53125

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the smsc75xx_rx_fixup() function in drivers/net/usb/smsc75xx.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Use-after-free

EUVDB-ID: #VU113101

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38350

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the qdisc_alloc_handle() and qdisc_tree_reduce_backlog() functions in net/sched/sch_api.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Use-after-free

EUVDB-ID: #VU113247

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38392

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the idpf_alloc_dma_mem() and idpf_free_dma_mem() functions in drivers/net/ethernet/intel/idpf/idpf_lib.c, within the idpf_ctlq_init_rxq_bufs(), idpf_ctlq_shutdown(), idpf_ctlq_add(), idpf_ctlq_send(), idpf_ctlq_clean_sq(), idpf_ctlq_post_rx_buffs(), wr32() and idpf_ctlq_recv() functions in drivers/net/ethernet/intel/idpf/idpf_controlq.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Improper locking

EUVDB-ID: #VU113279

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38449

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the drm_gem_fb_destroy() and drm_gem_fb_init_with_funcs() functions in drivers/gpu/drm/drm_gem_framebuffer_helper.c, within the drm_gem_private_object_fini(), drm_gem_object_exported_dma_buf_free(), drm_gem_object_handle_put_unlocked() and drm_gem_handle_create_tail() functions in drivers/gpu/drm/drm_gem.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Integer overflow

EUVDB-ID: #VU115180

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-40928

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an integer overflow when parsing JSON data. A remote attacker can pass specially crafted data to the application, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

IBM Qradar SIEM: 7.5.0 - 7.5.0 Update Pack 14

• cpe:2.3:a:ibm_corporation:ibm_qradar_siem:7.5.0:Update_Pack_14:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7250971

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.