What is the CVSS score of EUVD-2025-209012?

EUVD-2025-209012 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Red Hat are affected by EUVD-2025-209012?

Organizations using mtrojnar Osslsigncode affected at face critical risk from CVE-2025-70888, a improper privilege management vulnerability rated CVSS 9.8.. A patch is available.

How to fix or mitigate EUVD-2025-209012?

Within 24 hours: Identify all affected systems running mtrojnar Osslsigncode affected at and apply vendor patches immediately. Monitor vendor channels for patch availability.

Red Hat EUVD-2025-209012

| CVE-2025-70888 CRITICAL

Improper Privilege Management (CWE-269)

2026-03-25 mitre

GHSA-m387-6h4v-93hp

Privilege Escalation Red Hat Suse

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

10.0 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 09, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 19:32 euvd

EUVD-2025-209012

Analysis Generated

Mar 25, 2026 - 19:32 vuln.today

CVE Published

Mar 25, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

AnalysisAI

A privilege escalation vulnerability exists in osslsigncode (mtrojnar) versions 2.10 and earlier within the osslsigncode.c component, allowing remote attackers to escalate privileges. The vulnerability affects users of the osslsigncode code signing utility. While CVSS scoring is not yet available, referenced GitHub issues and pull requests suggest this is an authenticated or context-dependent issue that has been identified and likely patched.

Technical ContextAI

osslsigncode is a tool used for digitally signing code using OpenSSL, commonly deployed in cross-platform build and release environments. The vulnerability resides in the osslsigncode.c component, which handles the core signing logic. Without a specific CWE classification provided, the privilege escalation likely stems from improper input validation, insecure file operations, or unsafe handling of certificate/signature data within the signing process. The tool is widely used in open-source and commercial software supply chains for Windows Authenticode signing on non-Windows platforms. The affected CPE indicates the broader osslsigncode product line (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), though the vendor is mtrojnar per the GitHub repository evidence.

RemediationAI

Upgrade osslsigncode to version 2.11 or later; the patch is available in the mtrojnar GitHub repository (https://github.com/mtrojnar/osslsigncode/pull/477). Organizations using osslsigncode in automated build pipelines should apply the patch immediately and validate signing workflows post-update. Until patching is feasible, restrict osslsigncode execution to sandboxed or isolated build environments with minimal privilege escalation surface and disable unnecessary file system or network access. Code signing operations should run under a dedicated unprivileged service account with no system-level privileges to limit escalation impact.