HP Audio Driver CVE-2025-10577

Exploitation requires local code execution or an interactive local session on an affected HP PC running the vulnerable Sound Research SECOMN64 audio driver package, plus at least low-level user privileges (PR:L) - it is NOT remotely exploitable and needs no user interaction. Limiting factors: the attacker must already have a foothold on the specific HP models that ship this audio package; machines without the SECOMN64 driver or with the updated HP audio package installed are not affected. Exact vulnerable model list and fixed versions are defined in HP bulletin hpsbhf04051.

This is a credible but not emergency-grade privilege-escalation issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) describes a local attacker who already holds low-level privileges and, with low attack complexity and no user interaction, can achieve full compromise of the local system (VC:H/VI:H/VA:H, scope confined - SC/SI/SA:N). CWE-266 (Incorrect Privilege Assignment) is consistent with a driver that grants more access than it should. The real-world exploitation signals, however, are weak-to-moderate: EPSS is only 0.13% (2nd percentile), there is no CISA KEV listing, and no public exploit code was identified. The 8.5 score is driven by high local impact rather than by remote reachability or observed exploitation. Net: treat as a routine-to-elevated patch priority - meaningful for a post-compromise or insider/local-malware escalation path, but not a widely-exploited internet-facing threat. Note the local-only vector means it is NOT remotely exploitable and requires an attacker to already have a foothold on the HP endpoint.

An attacker who already has a standard (low-privileged) local account or has executed malware on an affected HP PC abuses the Sound Research SECOMN64 audio driver's incorrect privilege handling to escalate to SYSTEM/administrator. No user interaction and no remote access are involved. No public exploit code has been identified at the time of analysis.