CVE-2025-10576

HighCVSS 8.5/10Last modified Oct 8, 2026

Description

Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. HP is releasing updated audio packages to mitigate the potential vulnerabilities.

Metrics

CVSS 4.0 8.5/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-105778.5Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, whi CVE-2025-105787.8A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could CVE-2025-105795.3The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabili CVE-2025-10588.1CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is do CVE-2025-105806.4The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via mu CVE-2025-105817.8A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a lo CVE-2025-105828.8The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due CVE-2025-105833.5The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 v CVE-2025-105845.4A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_an CVE-2025-105859.8Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2025-105869.8The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘event_venue’ parameter in all versions up to, and includin CVE-2025-105879.8The Community Events plugin for WordPress is vulnerable to SQL Injection via the event_category parameter in all versions up to, and includi