#VU119817 State Issues in PCI Express (PCIe) Base Specification - CVE-2025-9614
Published: December 10, 2025
Vulnerability identifier: #VU119817
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-9614
CWE-ID: CWE-371
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
PCI Express (PCIe) Base Specification
PCI Express (PCIe) Base Specification
Software vendor:
PCI-SIG
PCI-SIG
Description
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to insufficient guidance on re-keying and stream flushing during device rebinding a PCIe device to a new Trusted Domain Interface (TDI) as described in PCI Express (PCIe) Base Specification. A local user can violate confidentiality or security objectives, leading to security restrictions bypass.
Remediation
The PCI-SIG has issued a Draft Engineering Change Notice (D-ECN) titled “IDE TLP Reordering Enhancement” to the Base Specification Rev 7.0. The D-ECN feature will be included in upcoming PCI specifications (Base 6.5 and 7.1) and can also be used in current Base 5.x systems through standard compliance procedures.