What is the CVSS score of CVE-2025-49849?

CVE-2025-49849 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-49849?

Within 24 hours: Identify all systems and users processing PRJ files; disable PRJ file processing where operationally feasible or restrict to trusted internal sources only. Within 7 days: Implement network segmentation to isolate affected systems; deploy monitoring for abnormal process behavior and memory access patterns; communicate risk assessment to business owners. Within 30 days: Establish a vendor patch monitoring process; evaluate alternative file formats or third-party solutions; conduct a comprehensive audit of historical PRJ file processing for potential compromise indicators.

CVE-2025-49849

EUVD-2025-18552 HIGH

Out-of-bounds Read (CWE-125)

2025-06-17 ics-cert@hq.dhs.gov

Buffer Overflow Information Disclosure Memory Corruption

8.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18552

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 19:15 nvd

HIGH 8.4

DescriptionCVE.org

An Out-of-bounds Read vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as reading and writing past the end of allocated data structures.

AnalysisAI

CVE-2025-49849 is an out-of-bounds read vulnerability in PRJ file parsing that enables memory corruption through insufficient validation of user-supplied data. The vulnerability affects applications processing PRJ files (commonly associated with project management software) and allows local attackers with user interaction to read and write beyond allocated memory boundaries, potentially leading to information disclosure or code execution. While the CVSS score is moderately high (8.4), real-world exploitability depends on KEV status and active exploitation reports, which are not currently documented in available intelligence.

Technical ContextAI

This vulnerability resides in the PRJ file parser implementation, likely within a project management or CAD application. The root cause is classified under CWE-125 (Out-of-bounds Read), which occurs when software reads from memory locations outside the boundaries of allocated buffers. PRJ files typically contain structured project metadata that must be parsed and validated; the lack of proper bounds checking during parsing allows attackers to craft malicious PRJ files that trigger out-of-bounds memory access. The vulnerability suggests inadequate input validation at the file format parsing layer, where array indexing or pointer arithmetic fails to verify that offsets/sizes remain within allocated structures. This is a common issue in legacy file format parsers that predate modern memory safety practices.

RemediationAI

Without access to vendor advisories or patch information in the provided data: (1) Apply security patches from the affected product vendor immediately upon release; (2) Implement input validation filters to reject malformed or suspicious PRJ files before parsing; (3) Run file parsing in sandboxed environments when handling untrusted PRJ files; (4) Disable PRJ file import if not essential to operations; (5) Monitor vendor security bulletins (Microsoft Security Update Guide, relevant CAD vendors) for patched versions; (6) For development teams: implement bounds checking in file parsers using safe languages (Rust, modern C++ with bounds libraries) or static analysis tools to detect out-of-bounds access patterns. Specific patch versions should be obtained from vendor security advisories once released.